Kalifast
Monthly
OS command injection in KaliFast's Git remote configuration endpoint allows any authenticated user - including holders of free self-registered accounts - to execute arbitrary commands on the server with www-data privileges by supplying crafted shell metacharacters in the ei_git_repo_url parameter. The flaw is rated 8.7 (CVSS 4.0) and assessed as CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, since the low-privilege prerequisite is trivially satisfied by open registration on any reachable instance. It is fixed in version 2026061802; no public exploit code has been identified at time of analysis, and vulnerability-source priority places remediation in the this-week window.
OS command injection in KaliFast's Git remote configuration endpoint allows any authenticated user - including holders of free self-registered accounts - to execute arbitrary commands on the server with www-data privileges by supplying crafted shell metacharacters in the ei_git_repo_url parameter. The flaw is rated 8.7 (CVSS 4.0) and assessed as CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, since the low-privilege prerequisite is trivially satisfied by open registration on any reachable instance. It is fixed in version 2026061802; no public exploit code has been identified at time of analysis, and vulnerability-source priority places remediation in the this-week window.