Threats tagged 'ghsa-f563-j7vj-6j8f'

CVE-2026-65184 is a critical vulnerability in the root-privileged wsserver terminal-bridge daemon. The daemon constructs shell commands directly from client-supplied WebSocket fields and executes them via system() and popen() calls without any quoting, escaping, or character-set validation. Additionally, the daemon's public-key session path lacks appliance-session checks, increasing the risk of unauthorized command execution.