CVE-2026-108944 — Katalog CVE

csirt@kutim:~/threat-intel/cve/CVE-2026-108944

CVSS 4.8 · Medium EPSS 0,12%

Kerentanan Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'). Skor CVSS 3.1 4.8 (Medium) menurut vuldb.com.

Deskripsi (NVD)

A security vulnerability has been detected in repository RAE up to a4d18c4db766419cbe7cb8c02cd9f7ceb0ec9041. Affected by this vulnerability is the function get_obj_from_str of the file src/utils/model_utils.py of the component Config-Driven Model Instantiation. Such manipulation of the argument Target leads to code injection. The attack must be carried out locally. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.

Rincian

Terbit di NVD: 13 Oktober 2026
Terakhir diubah: 13 Oktober 2026
Status NVD: Deferred
CVSS 3.1: 4.8 (Medium), sumber vuldb.com
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CWE-94: Improper Control of Generation of Code ('Code Injection')
EPSS (30 hari): 0,12% peluang dieksploitasi; lebih tinggi dari 1,8% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 14 Okt 2026, 00:25 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.