CVE-2026-27208

Katalog CVE

CVSS 7.8 · High EPSS 1,2%

Kerentanan Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') pada bleon-ethical api-gateway-deploy. Skor CVSS 3.1 7.8 (High) menurut NVD.

Deskripsi (NVD)

bleon-ethical/api-gateway-deploy provides API gateway deployment. Version 1.0.0 is vulnerable to an attack chain involving OS Command Injection and Privilege Escalation. This allows an attacker to execute arbitrary commands with root privileges within the container, potentially leading to a container escape and unauthorized infrastructure modifications. This is fixed in version 1.0.1 by implementing strict input sanitization and secure delimiters in entrypoint.sh, enforcing a non-root user (appuser) in the Dockerfile, and establishing mandatory security quality gates.

Rincian

Terbit di NVD

24 Februari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
CWE-250: Execution with Unnecessary Privileges
CWE-269: Improper Privilege Management

EPSS (30 hari)

1,2% peluang dieksploitasi; lebih tinggi dari 66,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/bleon-ethical/api-gateway-deploy/security/advisories/GHSA-chh5-w73q-4gmm advisory vendor
• https://github.com/bleon-ethical/api-gateway-deploy/releases/tag/Security release notes