What is the CVSS score of CVE-2026-37281?

CVE-2026-37281 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Zenshin CVE-2026-37281

EUVD-2026-30950 CRITICAL

OS Command Injection (CWE-78)

2026-05-19 mitre

GHSA-m4v3-5453-5w8r

Command Injection N A

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVE Published

Jun 22, 2026 - 06:03 cve.org

CRITICAL 9.8

Source Code Evidence Fetched

May 20, 2026 - 17:29 vuln.today

Analysis Generated

May 20, 2026 - 17:29 vuln.today

CVSS changed

May 20, 2026 - 17:22 NVD

9.8 (CRITICAL)

CVE Published

May 19, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

An OS command injection vulnerability in the /stream-to-vlc Express route in hitarth-gg Zenshin before 2.7.0 allows remote attackers to execute arbitrary commands via the url parameter.

AnalysisAI

Remote command execution in hitarth-gg Zenshin before 2.7.0 allows unauthenticated attackers to run arbitrary OS commands by sending a crafted url query parameter to the /stream-to-vlc Express route, which passed user input directly into a Node.js child_process.exec shell invocation. No public exploit identified at time of analysis, but a detailed write-up gist and the upstream fix commit publicly expose the vulnerable code path. EPSS is low (0.13%, 32nd percentile) but CVSS is 9.8 reflecting the trivial nature of the injection.

Technical ContextAI

Zenshin is an Electron-based anime streaming desktop application by hitarth-gg that embeds an Express HTTP backend to bridge BitTorrent streams to an external VLC media player. The vulnerable /stream-to-vlc route constructed a shell command string by concatenating a hard-coded vlcPath with the unescaped url query parameter and executed it via child_process.exec, which spawns a shell - the textbook root cause of CWE-78 (OS Command Injection). Because the Express server in the vulnerable build listened on all interfaces (the patch additionally binds it to 127.0.0.1), any process able to reach the configured backend port could invoke this endpoint. The fix removes the route entirely, replaces exec with spawn using an argv array and shell:false, and introduces a validateStreamUrl helper that restricts URLs to http://localhost or 127.0.0.1 paths under /streamfile/.

RemediationAI

Upgrade to Zenshin 2.7.0 or later, which is the vendor-released patch that removes the vulnerable /stream-to-vlc Express route, replaces child_process.exec with spawn using shell:false and an argv array, adds a validateStreamUrl allowlist restricting URLs to http://localhost or 127.0.0.1 under /streamfile/, and binds the Express backend to 127.0.0.1 only (see https://github.com/hitarth-gg/zenshin/commit/7d31c6edfbac978f0ad44c66d761bab9dcd2fa27). If immediate upgrade is not possible, block inbound traffic to the configured Zenshin backend port at the host firewall so only loopback can reach it (side effect: none for normal single-user desktop use, since the app talks to itself), and avoid running Zenshin on shared or untrusted networks; users may also manually edit main/index.js to add a '127.0.0.1' second argument to the app2.listen call as a stopgap, accepting that the /stream-to-vlc endpoint remains injectable from any local process until upgrade.