EUVD-2026-36769
GHSA-p5jh-x5gw-rm3f
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description states unauthenticated network input to the archiving pipeline triggers OS command execution, giving full host compromise, so AV:N/AC:L/PR:N/UI:N with C/I/A:H.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
4DescriptionCVE.org
An OS command injection vulnerability in the media archiving and export pipeline component of kanishka-linux Reminiscence v0.3.0 allows attackers to execute arbitrary commands via supplying a crafted input.
AnalysisAI
Remote code execution in kanishka-linux Reminiscence v0.3.0 allows unauthenticated attackers to execute arbitrary OS commands by supplying crafted input to the media archiving and export pipeline component. The CVSS 9.8 rating reflects network-reachable, unauthenticated exploitation with full impact to confidentiality, integrity, and availability, though no public exploit identified at time of analysis and EPSS sits at 0.67% (47th percentile) indicating limited observed exploitation pressure so far.
Technical ContextAI
Reminiscence is an open-source self-hosted bookmark and web-page archiving service maintained by kanishka-linux, used to capture and export local copies of online media. The flaw is classified under CWE-94 (Improper Control of Generation of Code, often categorized as Code Injection) and is described as OS command injection within the archiving and export pipeline, which typically wraps external utilities (e.g., wget, ffmpeg, image/video converters) and passes user-supplied URLs or filenames into shell-invoked commands. When such inputs are not strictly sanitized or are concatenated into a shell string, attacker-controlled metacharacters break out of the intended argument and run arbitrary commands under the Reminiscence service account. The CPE data is unhelpfully generic ('cpe:2.3:a:n/a:n/a:*'), so the affected component must be identified from the project itself rather than NVD's product catalog.
RemediationAI
No vendor-released patch identified at time of analysis - there is no upstream fix version listed in the input data, only a third-party gist and the NVD record. Operators of Reminiscence v0.3.0 should monitor the kanishka-linux/Reminiscence GitHub repository for a patched release and, in the interim, take the instance off the public internet by binding it to localhost or placing it behind an authenticating reverse proxy or VPN so the archiving/export endpoints are not reachable by untrusted users (trade-off: blocks legitimate remote use and any sharing features). Additional compensating controls: run the Reminiscence process as an unprivileged, sandboxed user (systemd with NoNewPrivileges, ProtectSystem=strict, or inside a rootless container) so a successful injection cannot pivot to host root (trade-off: requires reconfiguration of storage paths); and restrict outbound network egress from the host to break command-and-control if the injection is used to fetch a second-stage payload (trade-off: may interfere with legitimate archiving of external URLs, which is the core feature). Reference the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-50871 for updates.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-94 – Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today