Threats affecting pkg:github/eclipse-iofog/iofogctl

CVE-2026-113644 is an OS command injection vulnerability in Eclipse ioFog's iofogctl CLI tool versions 1.0.0 through 3.7.0 and 3.8.0-rc.1 through 3.9.1. The vulnerability arises because the provisioning key and CA certificate returned by the Controller API are concatenated into shell commands executed locally and over SSH on remote agent hosts. An attacker who can modify the API response can inject shell metacharacters, causing arbitrary commands to run on the agent host during deployment or attachment. This issue is fixed in version 3.9.2.