Which versions of OpenChamber are affected by EUVD-2026-53932?

OpenChamber 1.11.7 is vulnerable to remote code execution attacks that do not require authentication, putting all organizations using the default deployment configuration at direct risk of system…. A patch is available.

How to fix or mitigate EUVD-2026-53932?

Begin by immediately isolating all OpenChamber 1.11.7 instances in production within 24 hours and auditing access logs to the /api/fs/exec endpoint for any indicators of exploitation or reconnaissance activity. Within 7 days, apply the vendor-released patch to all affected instances and validate successful deployment across your entire environment. By day 30, conduct forensic review of historical logs to identify any actual breaches, complete post-incident analysis with security and development teams, and establish mandatory authentication configuration standards for all future deployments to prevent similar vulnerabilities.

OpenChamber EUVD-2026-53932

Q: What is the CVSS score of EUVD-2026-53932?

EUVD-2026-53932 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 1.1%.

| CVE-2026-53975 CRITICAL

OS Command Injection (CWE-78)

2026-08-06 VulnCheck

GHSA-xj9x-9j3p-fff9

RCE Docker Command Injection Node.js Openchamber Bohdan Triapitsyn

9.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Unauthenticated network POST to /api/fs/exec on default config gives arbitrary command execution as the app user, so PR:N/UI:N/AC:L with full C/I/A impact; scope unchanged as execution stays within the app's OS user.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Aug 06, 2026 - 15:15 vuln.today

Analysis Generated

Aug 06, 2026 - 15:15 vuln.today

CVE Published

Aug 06, 2026 - 14:06 cve.org

CRITICAL 9.3

DescriptionCVE.org

OpenChamber 1.11.7 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary shell commands by sending crafted POST requests to the /api/fs/exec endpoint, which passes commands verbatim to Node.js spawn() without any allowlist, blocklist, or argument validation. The authentication middleware becomes a no-op when UI_PASSWORD is not configured, matching the default Docker deployment, enabling attackers to execute arbitrary OS commands as the application user and retrieve full command output including stdout, stderr, and exit code from the server response.

Articles & Coverage 2

News 3 New Docker Vulnerabilities - 1 Critical, 2 High Severity Aug 06, 2026 News Critical RCE in Node.js OpenChamber 1.11.7 - CVE-2026-53975 Aug 06, 2026

AnalysisAI

Unauthenticated remote code execution in OpenChamber 1.11.7 lets remote attackers run arbitrary OS commands by POSTing to the /api/fs/exec endpoint, which hands input directly to Node.js spawn() with no allowlist, blocklist, or argument sanitization. Because the authentication middleware silently no-ops when UI_PASSWORD is unset - the state of the default Docker deployment - the endpoint is reachable without credentials and returns full stdout, stderr, and exit code to the attacker. Reported by VulnCheck; there is no public exploit identified at time of analysis and it is not listed in CISA KEV, though the flaw is trivially exploitable.

Technical ContextAI

OpenChamber is a Node.js/Electron application (with a web server component under packages/web and a desktop shell under packages/electron) that exposes an HTTP API. The vulnerability is a classic OS Command Injection (CWE-78): the /api/fs/exec route passes caller-supplied commands verbatim to Node.js child_process spawn() without validating the command name or its arguments, so any string an attacker supplies is executed by the underlying OS shell context as the application user. The core failure is compounded by an authentication design flaw - the auth middleware becomes a pass-through when the UI_PASSWORD environment variable is not set. Per the CPE cpe:2.3:a:bohdan_triapitsyn:openchamber:*, the affected component is the OpenChamber application itself; the vendor fix (docker-compose.yml changes) makes OPENCHAMBER_UI_PASSWORD a required variable that fails startup if unset when exposed via Docker, and the Electron main process was hardened to refuse LAN binding when no desktop UI password is configured.

RemediationAI

Apply the upstream fix from commit https://github.com/openchamber/openchamber/commit/f1b9506132faf6c564a2694c7f33b94421a49b4a; a released patched version tag was not provided in the input, so upgrade to the vendor's latest release that includes this commit and verify it is present. The fix makes OPENCHAMBER_UI_PASSWORD mandatory in docker-compose.yml (startup fails if unset when exposed via Docker) and stops the Electron shell from binding to the LAN when no desktop UI password is configured. As an immediate compensating control before patching, set a strong UI password (e.g. OPENCHAMBER_UI_PASSWORD="$(openssl rand -base64 24)") to re-enable the auth middleware; restrict network exposure by binding OpenChamber to loopback (127.0.0.1) instead of 0.0.0.0, or place it behind a reverse proxy / firewall that blocks external access to the /api/fs/exec endpoint. Note trade-offs: binding to loopback breaks legitimate remote/LAN access, and blocking /api/fs/exec at the proxy will disable any feature that legitimately relies on that endpoint. Consult the VulnCheck advisory (https://www.vulncheck.com/advisories/openchamber-unauthenticated-rce-via-api-fs-exec) for details.