Read the docs
TI-2026-26005 Aliases CVE-2026-33623GHSA-p8mm-644p-phmh

PinchTab: OS Command Injection via Profile Name in Windows Cleanup Routine Enables Arbitrary Command Execution

Priority HIGH 67CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Denial of service, Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-400 and CWE-78.

Summary

PinchTab is a standalone HTTP server that gives AI agents direct control over a Chrome browser. PinchTab `v0.8.4` contains a Windows-only command injection issue in the orphaned Chrome cleanup path. When an instance is stopped, the Windows cleanup routine builds a PowerShell `-Command` string using a `needle` derived from the profile path. In `v0.8.4`, that string interpolation escapes backslashes but does not safely neutralize other PowerShell metacharacters. If an attacker can launch an instance using a crafted profile name and then trigger the cleanup path, they may be able to execute arbitrary PowerShell commands on the Windows host in the security context of the PinchTab process user. This is not an unauthenticated internet RCE. It requires authenticated, administrative-equivalent API access to instance lifecycle endpoints, and the resulting command execution inherits the permissions of the PinchTab OS user rather than bypassing host privilege boundaries. Version 0.8.5 contains a patch for the issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.03016 87th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed pinchtab (pinchtab): 0.8.5github.com/pinchtab/pinchtab/cmd/pinchtab (Go): 0.8.5+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
pinchtabpinchtabbefore 0.8.50.8.5Patch availableCNA
—github.com/pinchtab/pinchtab/cmd/pinchtab (Go)before 0.8.50.8.5Patch availableGHSA-p8mm-644p-phmh
—github.com/pinchtab/pinchtab (Go)before 0.8.50.8.5Patch availableGHSA-p8mm-644p-phmh
  • pinchtab Vendorpinchtab Affected before 0.8.5 Fixed in 0.8.5 Patch available CNA
  • github.com/pinchtab/pinchtab/cmd/pinchtab (Go) Vendor— Affected before 0.8.5 Fixed in 0.8.5 Patch available GHSA-p8mm-644p-phmh
  • github.com/pinchtab/pinchtab (Go) Vendor— Affected before 0.8.5 Fixed in 0.8.5 Patch available GHSA-p8mm-644p-phmh

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:pinchtab:pinchtab:*:*:*:*:*:*:*:*before 0.8.5Vulnerablepinchtab
  • cpe:2.3:a:pinchtab:pinchtab:*:*:*:*:*:*:*:* Versions before 0.8.5 Vulnerable ·pinchtab

Remediation

  • Fix · CNA pinchtab (pinchtab) Fixed in 0.8.5
  • Fix · GHSA-p8mm-644p-phmh github.com/pinchtab/pinchtab/cmd/pinchtab (Go) Fixed in 0.8.5 Advisory →
  • Fix · GHSA-p8mm-644p-phmh github.com/pinchtab/pinchtab (Go) Fixed in 0.8.5 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-33623
  2. 2026-10-03 Alias added: GHSA-p8mm-644p-phmh

References

Exploit 1

Patch 1

Advisory 1

Other 1

  • TI-2026-23663 PinchTab: SSRF with Full Response Exfiltration via Download Handler CVSS 3.1HIGH 7.5
  • TI-2026-26003 PinchTab: Unapplied Rate Limiting Middleware Allows Unbounded Brute-Force of API Token CVSS 3.1MEDIUM 6.5
  • TI-2026-26004 A PinchTab Security Policy Bypass in /wait Allows Arbitrary JavaScript Execution CVSS 4.0MEDIUM 6.1
  • TI-2026-26001 PinchTab has Unauthenticated Blind SSRF in Task Scheduler via Unvalidated callbackUrl CVSS 3.1MEDIUM 5.5
  • TI-2026-26002 PinchTab: API Bearer Token Exposed in URL Query Parameter via Server Logs and Intermediary Systems CVSS 3.1MEDIUM 4.3
  • TI-2026-25523 PinchTab has Blind SSRF via browser-side redirect bypass in /download URL validation CVSS 3.1MEDIUM 5.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences