Description

A vulnerability was found in chenhg5 cc-connect up to 1.4.1. Affected by this vulnerability is the function Authenticate of the file core/webhook.go. The manipulation of the argument exec results in code injection. The attack may be performed from remote. The exploit has been made public and could be used. The reported GitHub issue was closed automatically due to inactivity.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-08-19T23:16:17.953Z",
  "pubdate": "2026-08-19T23:16:17.953Z",
  "executiveSummary": "A code injection vulnerability has been identified in chenhg5 cc-connect up to version 1.4.1, specifically within the Authenticate function located in core/webhook.go. This security flaw enables remote attackers to manipulate the exec argument, leading to arbitrary code execution within the context of the affected application.\nThe vulnerability poses a severe risk to confidentiality, integrity, and availability, potentially allowing unauthorized actors to compromise the underlying host system. The attack vector is fully remote, requiring network access to the vulnerable endpoint without prior authentication details specified in the disclosure.\nPublicly available exploit material increases the likelihood of active exploitation in the wild. Organizations utilizing vulnerable deployments of chenhg5 cc-connect up to version 1.4.1 should treat this issue with high priority, especially given that the corresponding GitHub issue was closed automatically due to inactivity rather than an explicit code fix.",
  "technicalDetails": "The vulnerability stems from improper neutralization of user-supplied input passed to the exec parameter within the Authenticate function in core/webhook.go. When a remote adversary submits crafted input via this argument, the application fails to adequately sanitize or validate the data before processing it through execution sinks.\nThe attack flow begins with a remote network request directed at the webhook handling component of chenhg5 cc-connect. The attacker crafts an HTTP request containing malicious payloads targeted at the exec argument within the authentication routine. Because the application insecurely evaluates or passes this manipulated argument to system command execution routines or dynamic evaluators, the injected instructions are executed by the host operating system with the privileges of the running application.\nThe vulnerable component is identified as the Authenticate function residing in the core/webhook.go file of the codebase. Affected software versions include all releases of chenhg5 cc-connect up to and including version 1.4.1.\nThe exploitation vector operates entirely over the network, allowing remote attackers to initiate attacks without leveraging internal network positioning. While specific fine-grained privilege requirements are not detailed, successful exploitation grants the adversary the execution privileges assigned to the running instance of chenhg5 cc-connect.\nPost-exploitation impact includes complete system compromise, unauthorized data access, execution of arbitrary shell commands, and potential lateral movement within the affected network environment. The presence of publicly available exploits significantly lowers the technical barrier for malicious actors attempting to weaponize this vulnerability."
}