OS command injection in Ministry of Justice UYAP Document Editor
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-78.
Summary
UYAP Document Editor from Ministry of Justice General Directorate of Information Technology is affected before 5.4.20 and before 5.4.21 on Windows, Linux and iOS. Special elements are not neutralized before being used in an OS command, which allows OS command injection (CWE-78). A local attacker without privileges can run OS commands when a user interacts with the product.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Description from the CNA
Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Ministry of Justice General Directorate of Information Technology UYAP Document Editor on Windows and Linux and Ministry of Justice General Directorate of Information Technology UYAP Document Editor on iOS allows OS Command Injection. This issue affects UYAP Document Editor: before 5.4.20; UYAP Document Editor: before 5.4.21.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Ministry of Justice General Directorate of Information Technology | UYAP Document Editor | before 5.4.20 | 5.4.20 | Patch available | CNA |
| Ministry of Justice General Directorate of Information Technology | UYAP Document Editor | before 5.4.21 | 5.4.21 | Patch available | CNA |
- UYAP Document Editor VendorMinistry of Justice General Directorate of Information Technology Affected before 5.4.20 Fixed in 5.4.20 Patch available CNA
- UYAP Document Editor VendorMinistry of Justice General Directorate of Information Technology Affected before 5.4.21 Fixed in 5.4.21 Patch available CNA
Remediation
Fixed versions are 5.4.20 and 5.4.21 for UYAP Document Editor, one for each affected range.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
- Fix · CNA UYAP Document Editor (Ministry of Justice General Directorate of Information Technology) Fixed in 5.4.20
- Fix · CNA UYAP Document Editor (Ministry of Justice General Directorate of Information Technology) Fixed in 5.4.21
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Ministry of Justice General Directorate of Information Technology UYAP Document Editor 5.4.20, 5.4.21
2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2026-70972 UYAP Document Editor Insecure Deserialization Enables Remote Code ExecutionPriority MEDIUM 40
Timeline
- 2026-10-12 Threatist record created from CVE-2026-18390
- 2026-10-12 Alias added: GHSA-mwwg-r5rc-h3pj
- 2026-10-12 CISA SSVC decision points changed
- 2026-10-12 Priority changed: MEDIUM → LOW
- 2026-10-14 Fix available: Ministry of Justice General Directorate of Information Technology/UYAP Document [email protected] · CNA
References
More Ministry of Justice General Directorate of Information Technology vulnerabilities
- TI-2026-70972 UYAP Document Editor Insecure Deserialization Enables Remote Code Execution CVSS 3.1HIGH 8.8
Sources
- CVE-2026-18390 · CVE Program
- CVE-2026-18390 · NVD
- FIRST EPSS
- GHSA-mwwg-r5rc-h3pj · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences