CVE-2026-19702: CWE-78 Improper neutralization of special elements used in an OS command ('OS command injection') in TÜBİTAK BİLGEM Software Technologies Research Institute Pardus Boot Repair

This vulnerability (CVE-2026-19702) involves improper neutralization of special elements used in OS commands (CWE-78) in Pardus Boot Repair software developed by TÜBİTAK BİLGEM Software Technologies Research Institute. Specifically, version 1.0.7 is affected, allowing an attacker to perform OS command injection. The CVSS 3.1 base score is 7.8, indicating a high severity with local attack vector, low attack complexity, no privileges required, user interaction required, and impacts to confidentiality, integrity, and availability. The vulnerability is published and assigned by TR-CERT, but no patch or official remediation level has been provided yet.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary OS commands on the affected system with the privileges of the user running Pardus Boot Repair. This can lead to full compromise of confidentiality, integrity, and availability of the system. The attack requires local access and user interaction but no privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict local access to trusted users only and avoid running Pardus Boot Repair version 1.0.7 in untrusted environments.