TI-2026-69162 CVE-2026-107202 · GHSA-qrj2-qqx7-wqxqCommand injection in h-ui administrative APIPriority MEDIUM 49A command injection vulnerability exists in the h-ui (version v0.0.25 and below) administrative API due to improper validation of the listen configuration field.CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.00777 · Published 2026-10-07 · No fix listed CWE-77