CVE-2026-107202: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in jonssonyan h-ui
Description
A command injection vulnerability exists in the h-ui (version v0.0.25 and below) administrative API due to improper validation of the listen configuration field. When an authenticated administrator submits a value containing shell metacharacters, the application constructs nftables/iptables rule strings using fmt.Sprintf and executes them via bash -c as root. Because the listen field lacks port or format validation, arbitrary OS commands can be injected and executed with root privileges.
CVSS v3.1
Score 9.1critical
Affected software
jonssonyan
h-ui
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability in jonssonyan's h-ui (version 0.0.25 and earlier) involves improper neutralization of special elements in the listen configuration field of the administrative API. When an authenticated administrator submits input containing shell metacharacters, the application uses fmt.Sprintf to build nftables/iptables command strings and executes them with root privileges via bash -c. Due to lack of validation on the listen field, arbitrary OS command injection is possible, leading to root-level command execution.
Potential Impact
An authenticated administrator can inject arbitrary OS commands executed with root privileges, potentially compromising the entire system. This elevates the risk of full system compromise, data loss, or unauthorized control over the host running the h-ui application.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrative access to trusted users only and avoid submitting untrusted input in the listen configuration field. Monitor vendor channels for official patches or updates addressing this issue.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- certcc
- Date Reserved
- 2026-10-07T14:22:10.000Z
- State
- PUBLISHED
Threat ID: 6ac65be92cdf04f656586d74
Added to database: 10/07/2026, 14:49:13 UTC
Last enriched: 10/07/2026, 15:03:20 UTC
Last updated: 10/07/2026, 21:04:06 UTC
Views: 16
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.