EUVD-2026-63172
GHSA-wfx9-6h8h-f3gm
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable, no-auth webhook handler; impact set to Low across CIA to match provided 4.0 vector, pending clarification of exec scope.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was found in chenhg5 cc-connect up to 1.4.1. Affected by this vulnerability is the function Authenticate of the file core/webhook.go. The manipulation of the argument exec results in code injection. The attack may be performed from remote. The exploit has been made public and could be used. The reported GitHub issue was closed automatically due to inactivity.
AnalysisAI
Remote code injection in chenhg5 cc-connect up to version 1.4.1 allows unauthenticated network attackers to execute arbitrary code by manipulating the exec argument passed to the Authenticate function in core/webhook.go. Tagged by reporters as RCE-capable, the vulnerability stems from unsanitized user input reaching a code execution path within the Go webhook handler. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The webhook endpoint in cc-connect must be network-accessible to attackers - this is the intended deployment mode of a webhook receiver, making this condition met by default in any standard deployment. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms low-complexity, unauthenticated network exploitation with no required user interaction - a highly exploitable posture. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A remote, unauthenticated attacker sends a crafted HTTP request to the cc-connect webhook endpoint, supplying a malicious value in the `exec` parameter. The `Authenticate` function in `core/webhook.go` processes this input without sanitization and passes it to a code or command execution context. … |
| Remediation | No vendor-released patch has been identified at time of analysis - the upstream GitHub issue was closed due to inactivity without resolution. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-94 – Code Injection
View allSame technique Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today