OS command injection in SHIRASAGI allows command execution
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-78.
Summary
SHIRASAGI Project's SHIRASAGI from v1.19.0 through v1.21.0 contains an OS command injection flaw (CWE-78) because special characters in input are not neutralized before an OS command is built. An authenticated attacker with low privileges can execute arbitrary OS commands over the network on the system running the product.
Written with Claude Haiku 5.5 from the sources below · 2026-11-05
Description from the CNA
An OS command injection vulnerability exists in SHIRASAGI, which may allow an authenticated attacker to execute arbitrary OS commands on the system running the product.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| SHIRASAGI Project | SHIRASAGI | v1.19.0 – v1.21.0 | — | No fix listed | CNA |
- SHIRASAGI VendorSHIRASAGI Project Affected v1.19.0 – v1.21.0 Fixed in — No fix listed CNA
CPE names Threatist (inferred) · 1
Inferred from how NVD named this product before; not given by a source.
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:ss-proj:shirasagi:*:*:*:*:*:*:*:* | — | — | SHIRASAGI Project |
- cpe:2.3:a:ss-proj:shirasagi:*:*:*:*:*:*:*:* Versions — — ·SHIRASAGI Project
Remediation
The sources list no fixed version for SHIRASAGI.
Written with Claude Haiku 5.5 from the sources below · 2026-11-05
Timeline
- 2026-11-05 Threatist record created from CVE-2026-118869
- 2026-11-05 Alias added: GHSA-pf5w-w956-56pv
- 2026-11-05 CISA SSVC decision points changed
- 2026-11-05 Priority changed: MEDIUM → LOW
- 2026-11-06 Priority changed: LOW → MEDIUM
More SHIRASAGI Project vulnerabilities
- TI-2023-22281 Late-Unicode normalization vulnerability in SHIRASAGI CVSS 3.1MEDIUM 5.3
- TI-2022-21269 Open redirect in SHIRASAGI CVSS 3.1MEDIUM 6.1
- TI-2023-08683 Cross-site scripting in SHIRASAGI CVSS 3.1MEDIUM 5.4
- TI-2022-21285 Cross-site scripting in SHIRASAGI CVSS 3.1MEDIUM 5.4
- TI-2023-08684 Cross-site scripting in SHIRASAGI CVSS 3.1MEDIUM 4.8
- TI-2023-20583 Path traversal in SHIRASAGI CVSS 3.1HIGH 8.8
Sources
- CVE-2026-118869 · CVE Program
- CVE-2026-118869 · NVD
- FIRST EPSS
- GHSA-pf5w-w956-56pv · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences