{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-107202", "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b", "state": "PUBLISHED", "assignerShortName": "certcc", "dateReserved": "2026-10-07T14:22:10.000Z", "datePublished": "2026-10-07T14:26:49.905Z", "dateUpdated": "2026-10-07T14:26:49.905Z"}, "containers": {"cna": {"title": "CVE-2026-107202", "descriptions": [{"lang": "en", "value": "A command injection vulnerability exists in the h-ui (version v0.0.25 and below) administrative API due to improper validation of the listen configuration field. When an authenticated administrator submits a value containing shell metacharacters, the application constructs nftables/iptables rule strings using fmt.Sprintf and executes them via bash -c as root. Because the listen field lacks port or format validation, arbitrary OS commands can be injected and executed with root privileges."}], "source": {"discovery": "UNKNOWN"}, "affected": [{"vendor": "jonssonyan", "product": "h-ui", "versions": [{"status": "affected", "version": "0.0.25"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"}]}], "references": [{"url": "https://github.com/jonssonyan/h-ui"}], "x_generator": {"engine": "VINCE 3.0.49", "env": "prod", "origin": "https://cveawg.mitre.org/api/cve/CVE-2026-107202"}, "providerMetadata": {"orgId": "37e5125f-f79b-445b-8fad-9564f167944b", "shortName": "certcc", "dateUpdated": "2026-10-07T14:26:49.905Z"}}}}

{}

{"affected": [{"affectedData": [{"product": "h-ui", "vendor": "jonssonyan", "versions": [{"status": "affected", "version": "0.0.25"}]}], "source": "cret@cert.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A command injection vulnerability exists in the h-ui (version v0.0.25 and below) administrative API due to improper validation of the listen configuration field. When an authenticated administrator submits a value containing shell metacharacters, the application constructs nftables/iptables rule strings using fmt.Sprintf and executes them via bash -c as root. Because the listen field lacks port or format validation, arbitrary OS commands can be injected and executed with root privileges."}], "id": "CVE-2026-107202", "lastModified": "2026-10-07T16:02:48.300", "metrics": {}, "published": "2026-10-07T15:17:20.090", "references": [{"source": "cret@cert.org", "url": "https://github.com/jonssonyan/h-ui"}], "sourceIdentifier": "cret@cert.org", "vulnStatus": "Deferred"}

{}

{"created": "2026-10-07T15:30:17.652784+00:00", "title": "Command Injection in h-ui Administrative API Leading to Root Privileges", "updated": "2026-10-07T15:30:17.652790+00:00", "vendors": [], "weaknesses": ["CWE-78"]}