All vulnerabilities
CVE-2026-104584

reNgine up to v2.2.0 and current master branch (commit de4199222cca5618f1255930ce78987e47d43a99) is vulnerable to OS Command Injection via the custom_headers scan engine configuration field in web/reN

n/a n/a
Open in ThreatlineRecord JSON
CVSS
9.8Critical
ExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 19 Oct 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)1.59%Chance of exploitation activity in the next 30 days, higher than 75% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version yet
Published13 Oct 2026Updated 19 Oct 2026CVE List

What fixes it

No source in this snapshot names a fixed version.

Description

reNgine up to v2.2.0 and current master branch (commit de4199222cca5618f1255930ce78987e47d43a99) is vulnerable to OS Command Injection via the custom_headers scan engine configuration field in web/reNgine/tasks.py (fetch_url and dir_file_fuzz functions).

Text from CVE List

Affected versions 1

  • n/aaffected: n/aCVE List

References 2