EUVD-2026-54603Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local vector and low privileges required to manipulate PATH; no user interaction needed; full code execution yields high C/I/A with no scope change.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
4DescriptionCVE.org
NexTor IP Changer is a command-line tool that leverages the Tor network to periodically rotate a user's IP address. Versions prior to 2.0.0 have a command execution vulnerability due to unsafe use of shell=True with commands that rely on executable resolution through the PATH environment variable. An attacker controlling the execution environment can place malicious executables such as sudo earlier in the PATH, resulting in execution of attacker-controlled code. Version 2.0.0 fixes the issue.
AnalysisAI
PATH hijacking in NexTor IP Changer prior to 2.0.0 allows a local attacker with low privileges to execute arbitrary code by substituting malicious binaries for trusted executables such as sudo. The root cause is unsafe use of Python's subprocess with shell=True without resolving executables to absolute paths, making the tool vulnerable to CWE-78 (OS Command Injection) and CWE-426 (Untrusted Search Path). No public exploit or active exploitation has been identified at time of analysis; version 2.0.0 resolves the issue by hardcoding absolute paths for all system commands.
Technical ContextAI
NexTor IP Changer is a Python command-line utility that wraps Tor network commands to periodically rotate IP addresses. The vulnerability arises from Python's subprocess module invoked with shell=True, which delegates command execution to the system shell (e.g., /bin/sh -c). When the tool calls executables by name rather than by absolute path, the shell performs PATH-based resolution at runtime. An attacker who controls the PATH environment variable before tool execution can prepend a writable directory containing a maliciously named binary (e.g., a fake sudo or tor), causing the shell to resolve and execute the attacker's payload instead of the legitimate system binary. The release notes confirm three related CWEs were addressed in v2.0.0: CWE-78 (OS Command Injection via shell=True), CWE-250 (Execution with Unnecessary Privileges), and CWE-426 (Untrusted Search Path). The fix replaced all shell-resolved invocations with absolute binary paths. No CPE string was provided in the input data.
RemediationAI
Upgrade to NexTor IP Changer v2.0.0 immediately; the release is available at https://github.com/0x5t4l1n/NexTOR_IP_CHANGER/releases/tag/v2.0 and resolves all three CWEs (CWE-78, CWE-250, CWE-426) by replacing shell-resolved executable calls with absolute paths. If upgrading is not immediately possible, restrict execution of NexTor IP Changer to a controlled, single-user environment where untrusted users cannot manipulate the PATH variable or write to PATH directories that precede /usr/bin or /bin in resolution order. Avoid running the tool in shared shells, containerized environments with writable mounts, or any context where environment variables can be influenced by a different security principal. Note that any workaround relying on environment hardening is fragile and does not address the underlying unsafe shell invocation pattern - patching to v2.0.0 is the only reliable fix.
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today