KaliFast EUVD-2026-112022

Requires a reachable KaliFast instance and an authenticated session, but the description states free self-registration is available, so any attacker who can reach the application can obtain the required low-privilege account. The specific trigger is supplying attacker-controlled shell metacharacters in the ei_git_repo_url parameter of the Git remote configuration endpoint; exploitation therefore depends on access to that Git remote configuration feature. Limiting factors: the endpoint requires authentication (PR:L, satisfied via free registration), and resulting code executes only with www-data privileges rather than root, bounding direct impact to the web service account unless combined with a separate privilege escalation.

This is a credible, actionable vulnerability rather than an inflated high-CVSS score. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes a network-reachable, low-complexity OS command injection requiring only low privileges - and the description confirms those privileges are trivially obtained because free self-registration is available, effectively lowering the authentication barrier to near-zero for any attacker who can reach the endpoint. The vuln.today decision label is 'this_week', indicating prioritized but not emergency remediation. No EPSS probability score, no CISA KEV listing, and no public PoC or exploit code are present in the supplied data, so there is no evidence of active or widespread exploitation at this time; the risk is driven by the inherent ease of exploitation (command injection is a well-understood, reliably weaponizable class) and the low access barrier, not by observed in-the-wild activity. The signals are consistent - no conflicts between the CVSS vector and the description. The one caveat limiting blast radius is that code executes as www-data rather than root, so direct impact is scoped to the web service account absent a separate privilege-escalation path.

An attacker registers a free account on an internet-reachable KaliFast instance, authenticates, and submits a crafted value in the ei_git_repo_url parameter of the Git remote configuration endpoint that embeds shell metacharacters. The injected command is executed by the server, giving the attacker arbitrary command execution as the www-data user. No public exploit code is identified at time of analysis, but the low complexity and authenticated-via-free-registration access make reliable exploitation straightforward.