CVE-2026-41015

State: Published
Severity: 7.4 High
Published: Apr 16, 2026
Updated: Apr 16, 2026
Reserved: Apr 16, 2026

Description

radare2 before 9236f44, when configured on UNIX without SSL, allows command injection via a PDB name to rabin2 -PP. NOTE: although users are supposed to use the latest version from git (not a release), the date range for the vulnerable code was less than a week, occurring after 6.1.2 but before 6.1.3.

Scores

CVSS	Score	Vector	Source
3.1	7.4 High	CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H	mitre

Weaknesses

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Affected Products

Product	Versions
radare2radare	01ca2f61fa43bd3f4b732447de31b16039d820c0 to before 9236f44a28812fe911814e1b3a7bcf1e4de5d3c2Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.