CVE-2026-105487

MEDIUMCVSS 6.3

Description

A vulnerability was found in yogeshojha reNgine up to 2.2.0. Affected by this vulnerability is the function subdomain_discovery of the file web/reNgine/tasks.py of the component listTargets Endpoint. The manipulation of the argument Name results in os command injection. The attack can be launched remotely. The exploit has been made public and could be used. The pull request to fix this issue awaits acceptance.

Timeline

Published:October 6th, 2026 2:17 AM

Last modified:October 6th, 2026 2:17 AM

CVSS Scoring

CVSS v3: 6.3 (MEDIUM)

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CVSS v2: 6.5

Weaknesses (CWE)

CWE-77 CWE-78

References & Reports

Advisories, patches, and third-party reports

https://github.com/yogeshojha/rengine/
https://github.com/yogeshojha/rengine/issues/1561
https://github.com/yogeshojha/rengine/pull/1562
https://vuldb.com/cve/CVE-2026-105487
https://vuldb.com/submit/986584
https://vuldb.com/vuln/413623
https://vuldb.com/vuln/413623/cti

Source: NIST NVD · Data may lag official sources by up to one minute