CVE-2026-11408: OS Command Injection in vertex-app vertex
A vulnerability was identified in vertex-app vertex up to 2026.02.12. This issue affects some unknown processing of the file app/model/LogMod.js of the component Log Viewer Endpoint. Such manipulation of the argument req.query leads to os command injection. The attack can be executed remotely. The exploit is publicly available and might be used. The name of the patch is 805d82e7100d49b79b3beb1b9420e8e458987198. It is best practice to apply a patch to resolve this issue.
AI Analysis
Technical Summary
This vulnerability in vertex-app vertex up to version 2026.02.12 allows remote attackers to perform OS command injection via crafted input in the req.query parameter processed by the Log Viewer Endpoint's LogMod.js file. The issue arises from insufficient input validation or sanitization, enabling execution of arbitrary OS commands. Although the exploit is publicly available, there are no confirmed reports of exploitation in the wild. The vulnerability has a CVSS 4.0 score of 5.3, indicating medium severity. A patch exists (commit 805d82e7100d49b79b3beb1b9420e8e458987198) and applying it is advised.
Potential Impact
Successful exploitation allows remote attackers to execute arbitrary operating system commands on the affected system with limited privileges, potentially leading to unauthorized actions or system compromise. The vulnerability affects the Log Viewer Endpoint component and can be triggered remotely without user interaction.
Mitigation Recommendations
A patch is available for this vulnerability identified by commit 805d82e7100d49b79b3beb1b9420e8e458987198. It is recommended to apply this patch promptly to remediate the issue. No vendor advisory content was provided to indicate otherwise, so patching is the best practice mitigation.
CVE-2026-11408: OS Command Injection in vertex-app vertex
Description
A vulnerability was identified in vertex-app vertex up to 2026.02.12. This issue affects some unknown processing of the file app/model/LogMod.js of the component Log Viewer Endpoint. Such manipulation of the argument req.query leads to os command injection. The attack can be executed remotely. The exploit is publicly available and might be used. The name of the patch is 805d82e7100d49b79b3beb1b9420e8e458987198. It is best practice to apply a patch to resolve this issue.
CVSS v4.0
Score 5.3medium
Affected software
pkg:github/vertex-app/vertexRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability in vertex-app vertex up to version 2026.02.12 allows remote attackers to perform OS command injection via crafted input in the req.query parameter processed by the Log Viewer Endpoint's LogMod.js file. The issue arises from insufficient input validation or sanitization, enabling execution of arbitrary OS commands. Although the exploit is publicly available, there are no confirmed reports of exploitation in the wild. The vulnerability has a CVSS 4.0 score of 5.3, indicating medium severity. A patch exists (commit 805d82e7100d49b79b3beb1b9420e8e458987198) and applying it is advised.
Potential Impact
Successful exploitation allows remote attackers to execute arbitrary operating system commands on the affected system with limited privileges, potentially leading to unauthorized actions or system compromise. The vulnerability affects the Log Viewer Endpoint component and can be triggered remotely without user interaction.
Mitigation Recommendations
A patch is available for this vulnerability identified by commit 805d82e7100d49b79b3beb1b9420e8e458987198. It is recommended to apply this patch promptly to remediate the issue. No vendor advisory content was provided to indicate otherwise, so patching is the best practice mitigation.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-06-05T18:33:57.349Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a247a6ce29bf47b50cae9b7
Added to database: 06/06/2026, 19:52:12 UTC
Last enriched: 06/14/2026, 09:38:26 UTC
Last updated: 07/31/2026, 19:22:57 UTC
Views: 99
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.