EUVD-2026-76149
GHSA-q527-g5jm-fj67
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
AV:L because exploitation requires local system access; PR:N because any local user can trigger the flaw without a privileged account; full CIA impact if root-level command execution results.
Primary rating from Vendor (usom).
CVSS VectorVendor: usom
Lifecycle Timeline
3DescriptionCVE.org
Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus Software allows OS Command Injection.
This issue affects Pardus Software: before 1.0.5.
AnalysisAI
OS command injection in TUBITAK BILGEM's Pardus Software (the software center/package management application for the Pardus Linux distribution) allows a local unprivileged user to execute arbitrary OS commands, likely with elevated privileges. Versions before 1.0.5 are affected; the fix is available in 1.0.5. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Local access to a system running Pardus Software before version 1.0.5 is required - the attacker must be able to execute processes as a local user (AV:L). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS 8.4 with vector AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H represents a high-severity local privilege escalation scenario. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Pardus Software to version 1.0.5 or later, which resolves the injection vulnerability. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all systems running Pardus Software versions before 1.0.5 and classify by criticality. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today