The vulnerability CVE-2026-76761 exists in chenhg5 cc-connect up to versions 1.4.0 and 1.4.1. It arises from improper handling of the exec argument in the shellExecCommand function located in core/engine.go of the Management API component, enabling OS command injection. This flaw can be exploited remotely without authentication or user interaction. Although an exploit is publicly available, the vendor has not provided an official fix or advisory, and the related GitHub issue was closed due to inactivity.

Successful exploitation allows remote attackers to execute arbitrary operating system commands on the affected system, potentially leading to unauthorized control or disruption of the application environment. The vulnerability is rated medium severity with a CVSS 4.0 score of 6.9, indicating a significant risk but not critical. There are no confirmed reports of exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is currently available, users should monitor vendor channels for updates. Until a fix is released, consider restricting access to the Management API component or applying network-level controls to limit exposure. Avoid using affected versions 1.4.0 and 1.4.1 in production environments if possible.