EUVD-2026-39153
GHSA-v3gg-5r82-j6rc
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable SOAR API with low complexity but requires an authenticated workflow-authoring user (PR:L); command execution yields full C/I/A impact within the unchanged plugin scope.
Primary rating from Vendor (rapid7).
CVSS VectorVendor: rapid7
Lifecycle Timeline
3DescriptionCVE.org
OS Command Injection vulnerability in Rapid7 InsightConnect Sed Plugin on Linux allows authenticated attackers to execute arbitrary OS commands via the expression parameter due to insufficient input validation.
AnalysisAI
OS command injection in the Rapid7 InsightConnect Sed Plugin on Linux lets an authenticated operator inject arbitrary shell commands through the plugin's expression parameter, which is passed to the underlying sed invocation without sufficient sanitization. Because InsightConnect is a SOAR orchestration platform, a low-privileged workflow author or connected user (PR:L) can achieve full code execution in the plugin's runtime context (C:H/I:H/A:H, CVSS 8.8). There is no public exploit identified at time of analysis and the issue is not on CISA KEV.
Technical ContextAI
InsightConnect is Rapid7's Security Orchestration, Automation and Response (SOAR) platform; plugins are containerized Linux integrations that perform discrete actions inside automation workflows. The Sed plugin wraps the GNU sed stream editor, exposing an expression parameter that supplies the sed script to run. The root cause is CWE-78 (Improper Neutralization of Special Elements used in an OS Command): user-supplied expression content is incorporated into an OS-level command/shell invocation without escaping or argument isolation, so shell metacharacters (;, |, $(), backticks) or sed's own e/e command execution facility can break out and run arbitrary commands. The affected component is identified by CPE cpe:2.3:a:rapid7:insightconnect_sed_plugin:*:*:*:*:*:*:*:* across all versions enumerated in the input.
RemediationAI
Update the InsightConnect Sed Plugin to the latest fixed version published on the Rapid7 extension marketplace (https://extensions.rapid7.com/extension/sed); no exact fix version was provided in the input data, so confirm the patched build number directly from that advisory before deploying - No vendor-released patch version identified at time of analysis in the supplied data. Because InsightConnect auto-manages plugin containers, ensure the orchestrator pulls the updated plugin image and that running workflows are restarted to use it. As compensating controls until patched: restrict who can author or edit workflows that include the Sed plugin (limit the low-privilege role that satisfies PR:L), remove or disable the Sed plugin from any workflow that does not strictly require it, and review existing workflows for untrusted or externally-influenced data flowing into the expression parameter - note that removing the plugin will break any automation that legitimately depends on sed transformations, so substitute a safer text-processing step where possible.
More in Insightconnect Sed Plugin
View allArbitrary file read in Rapid7's InsightConnect Sed Plugin on Linux exposes sensitive host filesystem contents to authent
Arbitrary file write in the Rapid7 InsightConnect Sed Plugin on Linux lets an authenticated attacker supply a crafted ex
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today