CVE-2026-68502

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-68502
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-68502.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-68502
Aliases
  • GHSA-fr84-8cfg-59w4
Published
2026-07-30T20:38:05.485Z
Modified
2026-08-02T03:32:16.174065937Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
LazyOwn: Unauthenticated Socket.IO `input` Event Reaches LazyOwn Command Dispatcher — Unauthenticated RCE
Details

LazyOwn RedTeam/APT Framework is an AI-powered C2 and red-team operations framework. Prior to 0.2.154, LazyOwn's lazyc2.py registers an unauthenticated Socket.IO input event handler that dispatches data.get('value') to LazyOwnShell.onecmd, reaching LazyOwnShell.docmd and subprocess.call(command, shell=True), allowing unauthenticated remote code execution in the C2 process. This issue is fixed in 0.2.154.

Database specific 
{
    "cwe_ids": [
        "CWE-306"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68502.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/grisuno/lazyown

Affected ranges

Type
GIT
Repo
https://github.com/grisuno/lazyown
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
2e1e3a7b5da8149ae28a970b5883aefa42921652
Database specific 
{
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.2.154"
        }
    ]
}

Affected versions

release/0.*
release/0.0.0
release/0.0.1
release/0.0.10
release/0.0.11
release/0.0.12
release/0.0.13
release/0.0.14
release/0.0.2
release/0.0.3
release/0.0.4
release/0.0.5
release/0.0.6
release/0.0.7
release/0.0.8
release/0.0.9
release/0.1.0
release/0.1.1
release/0.1.10
release/0.1.11
release/0.1.12
release/0.1.13
release/0.1.14
release/0.1.15
release/0.1.16
release/0.1.17
release/0.1.18
release/0.1.19
release/0.1.2
release/0.1.20
release/0.1.21
release/0.1.22
release/0.1.23
release/0.1.24
release/0.1.25
release/0.1.26
release/0.1.27
release/0.1.28
release/0.1.29
release/0.1.3
release/0.1.30
release/0.1.31
release/0.1.32
release/0.1.33
release/0.1.34
release/0.1.35
release/0.1.36
release/0.1.37
release/0.1.38
release/0.1.39
release/0.1.4
release/0.1.40
release/0.1.41
release/0.1.42
release/0.1.43
release/0.1.44
release/0.1.45
release/0.1.46
release/0.1.47
release/0.1.48
release/0.1.49
release/0.1.5
release/0.1.50
release/0.1.51
release/0.1.52
release/0.1.53
release/0.1.54
release/0.1.55
release/0.1.56
release/0.1.57
release/0.1.58
release/0.1.59
release/0.1.6
release/0.1.60
release/0.1.61
release/0.1.62
release/0.1.63
release/0.1.64
release/0.1.65
release/0.1.66
release/0.1.7
release/0.1.8
release/0.1.9
release/0.2.100
release/0.2.103
release/0.2.104
release/0.2.105
release/0.2.106
release/0.2.107
release/0.2.108
release/0.2.109
release/0.2.110
release/0.2.111
release/0.2.112
release/0.2.113
release/0.2.114
release/0.2.115
release/0.2.116
release/0.2.117
release/0.2.118
release/0.2.119
release/0.2.12
release/0.2.120
release/0.2.121
release/0.2.122
release/0.2.123
release/0.2.124
release/0.2.125
release/0.2.126
release/0.2.127
release/0.2.128
release/0.2.129
release/0.2.13
release/0.2.130
release/0.2.131
release/0.2.132
release/0.2.133
release/0.2.134
release/0.2.135
release/0.2.137
release/0.2.138
release/0.2.139
release/0.2.14
release/0.2.140
release/0.2.141
release/0.2.142
release/0.2.144
release/0.2.145
release/0.2.146
release/0.2.147
release/0.2.148
release/0.2.149
release/0.2.15
release/0.2.150
release/0.2.151
release/0.2.152
release/0.2.153
release/0.2.16
release/0.2.17
release/0.2.18
release/0.2.19
release/0.2.20
release/0.2.21
release/0.2.22
release/0.2.23
release/0.2.24
release/0.2.25
release/0.2.26
release/0.2.27
release/0.2.28
release/0.2.29
release/0.2.30
release/0.2.33
release/0.2.34
release/0.2.35
release/0.2.36
release/0.2.37
release/0.2.38
release/0.2.39
release/0.2.40
release/0.2.41
release/0.2.42
release/0.2.43
release/0.2.45
release/0.2.46
release/0.2.47
release/0.2.48
release/0.2.49
release/0.2.50
release/0.2.51
release/0.2.52
release/0.2.53
release/0.2.54
release/0.2.55
release/0.2.56
release/0.2.57
release/0.2.58
release/0.2.59
release/0.2.60
release/0.2.61
release/0.2.62
release/0.2.63
release/0.2.64
release/0.2.66
release/0.2.67
release/0.2.73
release/0.2.74
release/0.2.75
release/0.2.76
release/0.2.77
release/0.2.78
release/0.2.79
release/0.2.80
release/0.2.81
release/0.2.86
release/0.2.88
release/0.2.90
release/0.2.91
release/0.2.92
release/0.2.93
release/0.2.94
release/0.2.95
release/0.2.96
release/0.2.97
release/0.2.98
release/0.2.99
vrelease/0.*
vrelease/0.0.0
vvrelease/0.*
vvrelease/0.0.0
vvvrelease/0.*
vvvrelease/0.0.0
vvvrelease/0.1.0
vvvrelease/0.1.1
vvvrelease/0.1.2
vvvrelease/0.2.0
vvvrelease/0.2.1
vvvrelease/0.2.10
vvvrelease/0.2.11
vvvrelease/0.2.2
vvvrelease/0.2.3
vvvrelease/0.2.4
vvvrelease/0.2.5
vvvrelease/0.2.6
vvvrelease/0.2.7
vvvrelease/0.2.8
vvvrelease/0.2.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-68502.json"