Threats affecting pkg:github/archive/NetworkManager-vpnc

CVE-2026-91841 is a local privilege escalation vulnerability in NetworkManager-vpnc, a VPN plugin for NetworkManager. It allows a local unprivileged user to inject newline characters into the CA-File path, enabling execution of arbitrary commands as root. This vulnerability has a high severity rating with a CVSS score of 7.8. It affects all versions of NetworkManager-vpnc starting from version 0. No known exploits are reported in the wild. A vendor advisory from Red Hat is available but does not explicitly state patch status.

CVE-2026-91840 is a vulnerability in GNOME NetworkManager-vpnc that allows a local unprivileged user to escalate privileges to root. The flaw arises from improper neutralization of CRLF sequences, enabling an attacker to inject newline characters into the VPN username field. This injection manipulates the vpnc configuration, causing arbitrary programs to execute with root privileges when the malicious VPN connection is activated. The vulnerability has a high severity rating with a CVSS score of 7.8.