CVE-2026-18390: CWE-78 Improper neutralization of special elements used in an OS command ('OS command injection') in Ministry of Justice General Directorate of Information Technology UYAP Document Editor

The vulnerability identified as CVE-2026-18390 involves improper neutralization of special elements in OS commands within the UYAP Document Editor software. This flaw allows OS command injection, which can be exploited to execute arbitrary operating system commands. The affected versions are all releases before 5.4.20. The CVSS 3.1 vector indicates the attack requires local access with low attack complexity, no privileges, and user interaction, impacting confidentiality, integrity, and availability at a high level.

Successful exploitation of this vulnerability can lead to execution of arbitrary OS commands with the privileges of the affected application, potentially resulting in full compromise of the system's confidentiality, integrity, and availability. The high CVSS score reflects the critical nature of these impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor the Ministry of Justice General Directorate of Information Technology's advisories for updates. Until a fix is available, restricting local access and limiting user interaction with the vulnerable application may reduce risk.