Skip to main content

TCL reflector client CVE-2026-73147

MEDIUM
2026-08-13 vendor:ubuntu
Command Injection Red Hat
Share

Severity by source

vuln.today AI
7.5 HIGH

Network vector assumed for client connecting to remote reflector; AC:H because attacker must control the upstream service or intercept traffic; UI:R because a user must run the client.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
4.0 AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Red Hat
HIGH
qualitative

Lifecycle Timeline

1
Analysis Generated
Aug 14, 2026 - 20:10 vuln.today

DescriptionCVE.org

[GHSA-pc2g-2p95-4cr5: TCL command injection in reflector client]

AnalysisAI

TCL command injection in a reflector client component, reported via Ubuntu's vendor security channel (GHSA-pc2g-2p95-4cr5), allows an attacker to inject arbitrary TCL commands through unsanitized input processed by the client. The specific impact scope - including whether this enables OS-level command execution or is confined to the TCL interpreter - cannot be confirmed from available data, as no CVSS vector, CWE, or patch advisory has been published. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Attacker controls reflector endpoint
Delivery
Client connects and receives malicious response
Exploit
Unsanitized input passed to TCL interpreter
Execution
Arbitrary TCL or OS commands execute
Impact
Host system compromised
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The specific exploitation conditions are not confirmed from available data. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment Risk assessment is severely constrained by missing data. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker controlling or compromising a reflector server - or positioned to intercept traffic via a man-in-the-middle attack - sends a crafted response containing TCL metacharacters or eval-able command sequences. The reflector client processes this input through the TCL runtime without sanitization, triggering command execution in the context of the client process. …
Remediation No patch version or vendor advisory URL was available in the provided intelligence. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

Same technique Command Injection

View all
CVE-2024-21887 CRITICAL POC
9.1
CVE-2019-15107 CRITICAL POC
9.8
CVE-2024-51378 CRITICAL POC
9.8
CVE-2012-1823 CRITICAL POC
9.8
CVE-2016-1555 CRITICAL POC
9.8
CVE-2014-6271 CRITICAL POC
9.8
CVE-2024-55956 CRITICAL POC
9.8
CVE-2018-11138 CRITICAL POC
9.8

Vendor StatusVendor

Share

CVE-2026-73147 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy