CVE-2026-46368: Improper Neutralization of Special Elements used in a Command ('Command Injection') in mossdef-org luci-app-https-dns-proxy
luci-app-https-dns-proxy through 2025.12.29-5 — an optional LuCI web UI add-on for the https-dns-proxy package, distributed through the OpenWrt community packages feed and not installed by default — contains a command injection vulnerability in the setInitAction function. An authenticated user holding the luci.https-dns-proxy ACL permission can inject shell metacharacters through the 'name' parameter of a ubus RPC call to luci.https-dns-proxy setInitAction, resulting in arbitrary command execution as root on the underlying device. Core OpenWrt is not affected; only installations that have opted in to the luci-app-https-dns-proxy package are vulnerable.
AI Analysis
Technical Summary
CVE-2026-46368 is a command injection vulnerability in the luci-app-https-dns-proxy package, an optional LuCI web UI add-on for the https-dns-proxy package distributed via OpenWrt community packages. The flaw exists in the setInitAction function, where insufficient neutralization of special shell characters in the 'name' parameter of a ubus RPC call allows an authenticated user with appropriate ACL permissions to execute arbitrary commands as root on the device. The core OpenWrt system is unaffected, limiting the scope to systems with this package installed.
Potential Impact
Successful exploitation allows an authenticated user with luci.https-dns-proxy ACL permission to execute arbitrary commands with root privileges on the affected device. This can lead to full system compromise, including unauthorized control over the device and potential disruption of network services. The vulnerability does not affect devices without the optional luci-app-https-dns-proxy package installed.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to users with luci.https-dns-proxy ACL permission and consider removing the luci-app-https-dns-proxy package if it is not required. Monitor vendor channels for updates and apply official patches once released.
CVE-2026-46368: Improper Neutralization of Special Elements used in a Command ('Command Injection') in mossdef-org luci-app-https-dns-proxy
Description
luci-app-https-dns-proxy through 2025.12.29-5 — an optional LuCI web UI add-on for the https-dns-proxy package, distributed through the OpenWrt community packages feed and not installed by default — contains a command injection vulnerability in the setInitAction function. An authenticated user holding the luci.https-dns-proxy ACL permission can inject shell metacharacters through the 'name' parameter of a ubus RPC call to luci.https-dns-proxy setInitAction, resulting in arbitrary command execution as root on the underlying device. Core OpenWrt is not affected; only installations that have opted in to the luci-app-https-dns-proxy package are vulnerable.
CVSS v4.0
Score 8.7high
Affected software
pkg:github/stangri/luci-app-https-dns-proxyRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-46368 is a command injection vulnerability in the luci-app-https-dns-proxy package, an optional LuCI web UI add-on for the https-dns-proxy package distributed via OpenWrt community packages. The flaw exists in the setInitAction function, where insufficient neutralization of special shell characters in the 'name' parameter of a ubus RPC call allows an authenticated user with appropriate ACL permissions to execute arbitrary commands as root on the device. The core OpenWrt system is unaffected, limiting the scope to systems with this package installed.
Potential Impact
Successful exploitation allows an authenticated user with luci.https-dns-proxy ACL permission to execute arbitrary commands with root privileges on the affected device. This can lead to full system compromise, including unauthorized control over the device and potential disruption of network services. The vulnerability does not affect devices without the optional luci-app-https-dns-proxy package installed.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to users with luci.https-dns-proxy ACL permission and consider removing the luci-app-https-dns-proxy package if it is not required. Monitor vendor channels for updates and apply official patches once released.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-05-13T19:40:27.809Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a15af1f891d628fdc46fa15
Added to database: 05/26/2026, 14:33:03 UTC
Last enriched: 07/15/2026, 10:02:52 UTC
Last updated: 07/31/2026, 19:22:59 UTC
Views: 97
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.