Threat Intelligence Database

CVE-2026-92801 is a high-severity vulnerability in chenhg5 cc-connect up to version 1.5.0. The flaw involves incorrect authorization where the onCardAction handler for Feishu interactive card callbacks does not enforce per-user allowlist filtering. This allows attackers to dispatch agent commands by triggering card actions in admitted chats, bypassing intended per-user access controls.

A command injection vulnerability exists in chenhg5 cc-connect up to version 1.4.1 in the Management API component. The flaw is in the shellExecCommand function of core/engine.go, where manipulation of the exec argument allows remote OS command injection. The vulnerability has a CVSS score of 7.3 (medium severity). Public exploit code is available, but there are no known exploits in the wild. The reported GitHub issue was closed due to inactivity, and no patch or remediation information is provided.

A code injection vulnerability exists in the Authenticate function of the core/webhook.go file in chenhg5 cc-connect up to version 1.4.1. The vulnerability arises from manipulation of the exec argument and can be exploited remotely. The exploit code has been publicly disclosed. The vulnerability has a CVSS 3.1 base score of 7.3, indicating a medium severity level.