EUVD-2026-39160
GHSA-xqrw-3c79-7qc7
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Jun 29, 2026
Remote OS command injection in Rapid7's InsightConnect AWK Plugin (versions below 1.2.2 on Linux) lets attackers run arbitrary operating-system commands through the process_string action's text or expression parameters, which are unsafely concatenated into a shell command. The CVSS 9.8 rating reflects full confidentiality, integrity, and availability loss with no privileges or user interaction required by the vector. There is no public exploit identified at time of analysis, EPSS is low (0.55%), and CISA SSVC marks exploitation as none, so risk today is potential rather than observed.
Earlier versions of this analysis (2)
OS command injection in the process_string action of Rapid7's InsightConnect AWK Plugin (Linux) lets remote attackers run arbitrary operating-system commands by supplying crafted input to the text or expression parameters, which the plugin concatenates unsafely into a shell command. All versions before 1.2.2 are affected; the issue carries a 9.8 CVSS and full technical impact under SSVC, but EPSS is low (0.55%, 42nd percentile) and there is no public exploit identified at time of analysis. Vendor Rapid7 self-reported the flaw and has released a fixed version.
OS command injection in the Rapid7 InsightConnect AWK Plugin on Linux lets remote attackers run arbitrary operating-system commands by supplying crafted values to the 'text' or 'expression' parameters of the process_string action, which are unsafely concatenated into a shell command. The flaw affects the AWK Plugin component used within Rapid7's InsightConnect SOAR automation platform and was reported by the vendor. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Insightconnect Awk Plugin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable, low-complexity command injection with full host impact, but reaching a SOAR plugin action realistically requires authenticated/automated orchestrator access, so PR:L rather than PR:N.
Primary rating from Vendor (rapid7).
CVSS VectorNVD
Lifecycle Timeline
6DescriptionNVD
OS Command Injection vulnerability in the process_string action of Rapid7 InsightConnect AWK Plugin on Linux allows remote attackers to execute arbitrary OS commands via the text or expression parameters due to unsafe shell command construction in the processing pipeline.
Executive ViewAI
Rapid7's InsightConnect AWK Plugin on Linux contains a critical remote command injection vulnerability enabling unauthenticated attackers to execute arbitrary OS commands and achieve complete system compromise. Organizations deploying this plugin face potential unauthorized access and data loss if unpatched. A vendor patch (version 1.2.2 or later) is immediately available, making remediation the urgent priority.
Within 24 hours: Identify all InsightConnect deployments running AWK Plugin versions below 1.2.2 on Linux systems and assess exposure. Within 7 days: Deploy patch to upgrade AWK Plugin to version 1.2.2 or later across all affected systems. Within 30 days: Verify successful patching, review InsightConnect audit logs for suspicious activity on the plugin, and document remediation completion.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Exploit-DB