EUVD-2026-64730
GHSA-4cgq-vq27-gxqx
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AV:L because the crafted directory must be local; UI:R because victim must actively invoke 'Open Terminal'; PR:N as no attacker account privileges are needed; full C/I/A impact within the user's context.
Primary rating from Vendor (jpcert).
CVSS VectorVendor: jpcert
Lifecycle Timeline
4DescriptionCVE.org
Sakura Editor provided by Sakura Editor Development Community contains an OS command injection vulnerability. If a victim user is directed to edit a file in a crafted directory, arbitrary OS command may be executed on the user's PC when the user invokes "Open Terminal".
AnalysisAI
OS command injection in Sakura Editor (Windows text editor) enables arbitrary command execution on a victim's PC when they open a file from an attacker-crafted directory and invoke the 'Open Terminal' (Open PowerShell) feature. The vulnerability, tracked as JVN#74538868 and GHSA-6x2x-729r-wjh5 and reported by JPCERT, requires social engineering to place the victim's file in a path containing injected shell metacharacters. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two sequential user actions: (1) the victim must open a file that resides in an attacker-controlled or attacker-crafted directory path containing injected shell metacharacters, and (2) the victim must explicitly invoke the 'Open Terminal' (Open PowerShell) feature within Sakura Editor while that file is active. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.4 with vector AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H reflects a high-impact but socially-engineered local attack. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Sakura Editor v2.4.3 or later, available at https://github.com/sakura-editor/sakura/releases/tag/v2.4.3. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Windows systems running Sakura Editor and prioritize those where the application is non-critical for business operations; uninstall Editor on systems where it is not required. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today