NVIDIA OpenShell CVE-2026-65091

Exploitation requires that a victim user actively connect to or interact with an attacker-controlled or attacker-compromised gateway - this is the UI:R condition in the CVSS vector. The attacker must control a network endpoint that the OpenShell client treats as a gateway (e.g., through DNS hijacking, BGP manipulation, SSRF, a compromised gateway host, or by convincing the user to point their client at a malicious URL). No authentication on the attacker's side is required (PR:N). No special privileges are required on the victim system beyond having OpenShell installed and a user willing to initiate the gateway connection. Limiting factors: the required user interaction (UI:R) means fully automated mass exploitation without any user participation is not possible; exploitation is also constrained to platforms and versions where OpenShell is installed. Non-default or misconfigured gateway settings that direct clients to external, untrusted endpoints would substantially increase real-world risk.

The CVSS 8.8 score reflects a genuinely high-severity finding: network-accessible (AV:N), low complexity (AC:L), no attacker privileges required (PR:N), and high impact across all three pillars (C:H/I:H/A:H). The single limiting factor is UI:R - the victim must interact with the malicious gateway, which reduces the attack surface compared to a fully autonomous exploit. No EPSS score was provided in the input data, so exploitation probability cannot be quantified. The vulnerability is not listed in the CISA KEV catalog and no proof-of-concept code has been identified, indicating that as of this analysis, exploitation appears theoretical rather than observed. The realistic risk depends heavily on deployment architecture: organizations connecting OpenShell clients to externally-reachable or shared gateway infrastructure face substantially higher exposure than those in isolated, trusted network environments. The attacker-in-the-middle or rogue-gateway scenario is the primary threat model, which requires either network positioning or social engineering to succeed.

An attacker deploys a rogue gateway server mimicking a legitimate NVIDIA OpenShell endpoint, then lures a target user into connecting to it - for example, through DNS poisoning, a misconfigured gateway URL, or social engineering. The malicious gateway returns a crafted response containing shell metacharacters that OpenShell passes unsanitized to the OS command interpreter, achieving arbitrary code execution under the victim user's operating system context. No public proof-of-concept has been identified, but the CWE-78 injection class is well-understood and the attack complexity is rated low by the vendor.