CVE-2026-50874 describes an OS command injection vulnerability in kanishka-linux Reminiscence v0.3.0 specifically within the /manage/features/media component. The vulnerability allows attackers with low privileges and no user interaction to execute arbitrary system commands by providing specially crafted input. The CVSS 3.1 vector indicates network attack vector, low attack complexity, privileges required, no user interaction, unchanged scope, high confidentiality and integrity impact, and no availability impact. There is no vendor advisory or patch information available at this time.

Successful exploitation can lead to arbitrary command execution on the affected system, compromising confidentiality and integrity of the system. The attacker requires low privileges but can execute commands remotely without user interaction. Availability is not impacted according to the CVSS vector. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the /manage/features/media component and monitor for suspicious activity related to command execution attempts. Avoid exposing this component to untrusted networks or users.