What is the CVSS score of CVE-2026-4745?

CVE-2026-4745 has a CVSS 4.0 base score of 10.0 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/S:N/AU:Y/R:U/V:D/RE:L/U:Amber. EPSS exploitation probability: 0.0%.

Which versions of Perf Ninja are affected by CVE-2026-4745?

CVE-2026-4745 presents critical security risk, a code injection vulnerability rated CVSS 10.0.. A patch is available.

How to fix or mitigate CVE-2026-4745?

Within 24 hours: Identify all affected systems and apply vendor patches immediately. Validate that input sanitization is in place for all user-controlled parameters.

Perf Ninja CVE-2026-4745

EUVD-2026-14744 CRITICAL

Code Injection (CWE-94)

2026-03-24 GovTech CSG

GHSA-p4qv-w9rr-5cfp

Code Injection RCE Perf Ninja

10.0

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

10.0 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/S:N/AU:Y/R:U/V:D/RE:L/U:Amber

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/S:N/AU:Y/R:U/V:D/RE:L/U:Amber

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

EUVD ID Assigned

Mar 24, 2026 - 04:30 euvd

EUVD-2026-14744

Analysis Generated

Mar 24, 2026 - 04:30 vuln.today

Patch released

Mar 24, 2026 - 04:30 nvd

Patch available

CVE Published

Mar 24, 2026 - 03:27 nvd

CRITICAL 10.0

DescriptionCVE.org

Improper Control of Generation of Code ('Code Injection') vulnerability in dendibakh perf-ninja (labs/misc/pgo/lua modules). This vulnerability is associated with program files ldo.C.

This issue affects perf-ninja.

AnalysisAI

A code injection vulnerability exists in dendibakh perf-ninja's Lua modules (specifically in ldo.C within labs/misc/pgo), allowing improper control of code generation that can lead to remote code execution. The vulnerability affects all versions of perf-ninja as indicated by the CPE specification. An attacker can exploit this flaw to inject and execute arbitrary code, with a vendor patch now available to remediate the issue.

Technical ContextAI

The vulnerability resides in the Lua module handling code within perf-ninja's performance profiling and optimization toolkit, specifically in the ldo.C source file which manages Lua function calls and code execution. This is classified as CWE-94 (Improper Control of Generation of Code), a weakness where user-controlled input is insufficiently validated before being used to generate executable code. Lua, being a scripting language embedded in perf-ninja, creates a pathway for code injection when user input is concatenated or interpolated into Lua code without proper sanitization. The affected product identifier per CPE is cpe:2.3:a:dendibakh:perf-ninja:*:*:*:*:*:*:*:*, indicating all versions are potentially vulnerable.

RemediationAI

Apply the vendor patch released via GitHub pull request #129 (https://github.com/dendibakh/perf-ninja/pull/129) to remediate the code injection vulnerability. Users should update their perf-ninja installation to incorporate the patched ldo.C module from the main repository. Until patching is feasible, restrict network access to perf-ninja instances to trusted users and systems, disable or isolate Lua scripting features if not actively needed for profiling workflows, and monitor perf-ninja processes for unexpected code execution patterns.