PYSEC-2026-799
See a problem?- Import Source
- https://github.com/pypa/advisory-database/blob/main/vulns/crmsh/PYSEC-2026-799.yaml
- JSON Data
- https://api.osv.dev/v1/vulns/PYSEC-2026-799
- Aliases
- Published
- 2026-07-06T08:03:28.928585Z
- Modified
- 2026-07-07T11:45:44.500772317Z
- Severity
-
- 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- ClusterLabs crmsh vulnerable to shell code injection
- Details
-
An issue was discovered in ClusterLabs crmsh through 4.2.1. Local attackers able to call
crm history(whencrmis run) were able to execute commands via shell code injection to the crm history commandline, potentially allowing escalation of privileges. - References
-
- https://nvd.nist.gov/vuln/detail/CVE-2020-35459
- https://bugzilla.suse.com/show_bug.cgi?id=1179999
- https://github.com/ClusterLabs/crmsh
- https://github.com/ClusterLabs/crmsh/blob/a403aa15f3ea575adfe5e43bf2a31c9f9094fcda/crmsh/history.py#L476
- https://github.com/ClusterLabs/crmsh/releases
- https://lists.debian.org/debian-lts-announce/2021/01/msg00021.html
- https://www.openwall.com/lists/oss-security/2021/01/12/3
- http://www.openwall.com/lists/oss-security/2021/01/12/3
- https://pypi.org/project/crmsh
- https://github.com/advisories/GHSA-99xx-83jm-h24m
Affected packages
PyPI / crmsh
Package
- Name
- crmsh
- View open source insights on deps.dev
- Purl
- pkg:pypi/crmsh