CVE-2026-76761
chenhg5 cc-connect Management API engine.go shellExecCommand os command injection
- State
- Published
- Severity
- 6.9 Medium
- Published
- Aug 19, 2026
- Updated
- Aug 20, 2026
- Reserved
- Aug 19, 2026
Description
A vulnerability was identified in chenhg5 cc-connect up to 1.4.1. This affects the function shellExecCommand of the file core/engine.go of the component Management API. Such manipulation of the argument exec leads to os command injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The reported GitHub issue was closed automatically due to inactivity.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.9 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 7.3 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 3.0 | 7.3 High | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 2.0 | 7.5 High | AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR | VulDB |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
cc-connectchenhg5 |
|
References
- VDB-393231 | chenhg5 cc-connect Management API engine.go shellExecCommand os command injectionvdb-entrytechnical-description
- VDB-393231 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
- CVE-2026-76761 | CVE Analysis and Reportthird-party-advisory
- Submit #878948 | chenhg5 cc-connect 1.4.1 Command Injectionthird-party-advisory
- https://github.com/chenhg5/cc-connect/issues/1489exploitissue-tracking
- https://github.com/chenhg5/cc-connect/product
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.