CVE-2026-76761

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-76761

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-76761.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-76761

Published

2026-08-19T23:00:12Z

Modified

2026-08-22T03:31:12Z

Severity

5.5 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

chenhg5 cc-connect Management API engine.go shellExecCommand os command injection

Details

A vulnerability was identified in chenhg5 cc-connect up to 1.4.1. This affects the function shellExecCommand of the file core/engine.go of the component Management API. Such manipulation of the argument exec leads to os command injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The reported GitHub issue was closed automatically due to inactivity.

Database specific

{
    "cna_assigner": "VulDB",
    "cwe_ids": [
        "CWE-77",
        "CWE-78"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/76xxx/CVE-2026-76761.json"
}

References

Affected packages

Git / github.com/chenhg5/cc-connect

Affected ranges

Type

GIT

Repo

https://github.com/chenhg5/cc-connect

Events

Introduced

0938982a7ed0d1ff19eace69d60b955993fa3ce7

Last Affected

5d4c96dd12774574369e75b60084140101c9a59a

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "1.4.0"
        },
        {
            "last_affected": "1.4.0"
        },
        {
            "introduced": "1.4.1"
        },
        {
            "last_affected": "1.4.1"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

1.*

1.4.0

1.4.1

v1.*

v1.4.0

v1.4.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-76761.json"