CVE-2026-108944

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-108944
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-108944.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-108944
Published
2026-10-13T00:30:43Z
Modified
2026-10-14T02:47:08Z
Severity
  • 2.4 (Low) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X CVSS Calculator
Summary
repository RAE Config-Driven Model Instantiation model_utils.py get_obj_from_str code injection
Details

A security vulnerability has been detected in repository RAE up to a4d18c4db766419cbe7cb8c02cd9f7ceb0ec9041. Affected by this vulnerability is the function get_obj_from_str of the file src/utils/model_utils.py of the component Config-Driven Model Instantiation. Such manipulation of the argument Target leads to code injection. The attack must be carried out locally. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.

Database specific 
{
    "cna_assigner":  "VulDB",
    "cwe_ids":  [
        "CWE-74",
        "CWE-94"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/108xxx/CVE-2026-108944.json"
}
References

Affected packages

Git / github.com/bytetriper/rae

Affected ranges

Type
GIT
Repo
https://github.com/bytetriper/rae
Events
Introduced
a4d18c4db766419cbe7cb8c02cd9f7ceb0ec9041
Last Affected
a4d18c4db766419cbe7cb8c02cd9f7ceb0ec9041

Affected versions

Other
a4d18c4db766419cbe7cb8c02cd9f7ceb0ec9041

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-108944.json"