EUVD-2026-54604Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
AC:L overstates ease of exploitation; NOPASSWD sudo is a non-default, explicitly configured prerequisite that raises effective attack complexity to AC:H.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
3DescriptionCVE.org
NexTor IP Changer is a command-line tool that leverages the Tor network to periodically rotate a user's IP address. Versions prior to 2.0.0 execute privileged system commands using sudo and shell=True directly inside application logic. In environments where passwordless sudo (NOPASSWD) is enabled, privileged commands may execute silently without explicit user confirmation. Version 2.0.0 fixes the issue.
AnalysisAI
Privilege escalation in NexTor IP Changer versions prior to 2.0.0 stems from OS command injection (CWE-78) caused by invoking privileged system commands via sudo with shell=True, allowing shell metacharacter interpretation of unsanitized input. On systems where passwordless sudo (NOPASSWD) is configured for the executing account, an attacker with local low-privilege access can inject arbitrary OS commands that execute silently with root privileges. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; real-world risk is bounded by the NOPASSWD requirement and the tool's niche deployment footprint. Version 2.0.0 resolves the issue.
Technical ContextAI
NexTor IP Changer is a Python command-line utility that interfaces with the Tor network to periodically cycle the host's IP address. The root cause is CWE-78 (Improper Neutralization of Special Elements used in an OS Command), specifically the use of Python's shell=True flag in subprocess calls that also invoke sudo. When shell=True is set, the Python runtime passes the entire command string to the operating system shell (/bin/sh), which interprets metacharacters such as ;, &&, |, and backticks. If any portion of that string is derived from user-controlled input without sanitization, an attacker can append or inject additional shell commands that execute in the same privileged context as sudo. No formal CPE string was supplied in the input data; the affected artifact is the open-source project hosted at github.com/0x5t4l1n/NexTOR_IP_CHANGER, all releases prior to 2.0.0.
RemediationAI
The primary remediation is to upgrade NexTor IP Changer to version 2.0.0, which eliminates the insecure shell=True subprocess invocation pattern for privileged commands. The full advisory is available at https://github.com/0x5t4l1n/NexTOR_IP_CHANGER/security/advisories/GHSA-fpxg-q9p5-5wvm. If an immediate upgrade is not feasible, remove any NOPASSWD entries for accounts running NexTor from the sudoers file (e.g., via visudo); this forces interactive password prompting before privileged commands execute, breaking the silent injection chain - note this will interrupt automated or unattended use of the tool. As an additional layer, restrict execution of NexTor to dedicated, isolated user accounts that hold no other elevated permissions, minimizing the blast radius of any successful injection. Do not run the tool in environments where its argument inputs may be influenced by external or untrusted sources prior to patching.
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today