EUVD-2026-39151
GHSA-82jg-f393-8r2g
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable plugin action with low complexity and no user interaction, requiring an authenticated low-privilege account (PR:L); arbitrary command execution yields full C/I/A impact within the plugin's scope.
Primary rating from Vendor (rapid7).
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
8DescriptionNVD
OS Command Injection vulnerability in Rapid7 InsightConnect RPM Plugin on Linux allows authenticated attackers to execute arbitrary OS commands via the repo, key, or name parameters due to insufficient input sanitization in shell command construction.
AnalysisAI
OS command injection in the Rapid7 InsightConnect RPM Plugin on Linux lets authenticated users run arbitrary operating-system commands by injecting shell metacharacters into the repo, key, or name parameters, which are concatenated into a shell command without sanitization (CWE-78). All versions before 1.0.2 are affected. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated InsightConnect account or the ability to control workflow input (CVSS PR:L - low privileges, not unauthenticated), and the InsightConnect RPM Plugin (version < 1.0.2) must be installed and used so the attacker can invoke an action that consumes the repo, key, or name parameters, with those values reaching the plugin's shell-command construction path. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) describes a low-complexity, network-reachable attack requiring only low privileges, with full confidentiality, integrity and availability impact - consistent with arbitrary command execution. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who already holds a low-privilege InsightConnect account (or who can influence a workflow's input) supplies a crafted value such as a package name containing ';' followed by an arbitrary command into the RPM Plugin's name, repo, or key field. When the plugin builds and runs its shell command, the injected payload executes on the underlying Linux host with the plugin's privileges. … |
| Remediation | Vendor-released patch: 1.0.2 - upgrade the InsightConnect RPM Plugin to version 1.0.2 or later, the first release outside the affected '<1.0.2' range; obtain it from the Rapid7 extension page at https://extensions.rapid7.com/extension/rpm (see also EUVD-2026-39151 / https://nvd.nist.gov/vuln/detail/CVE-2026-8663). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all InsightConnect deployments to identify versions running RPM Plugin before 1.0.2. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today