Description

A vulnerability was identified in chenhg5 cc-connect up to 1.4.1. This affects the function shellExecCommand of the file core/engine.go of the component Management API. Such manipulation of the argument exec leads to os command injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The reported GitHub issue was closed automatically due to inactivity.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-08-19T23:16:18.540Z",
  "pubdate": "2026-08-19T23:16:18.540Z",
  "executiveSummary": "An OS command injection vulnerability has been identified in chenhg5 cc-connect up to version 1.4.1. The security flaw specifically resides within the Management API component, affecting the shellExecCommand function located in the core/engine.go source file.\nThe vulnerability allows remote threat actors to manipulate the execution argument, leading to arbitrary Operating System command execution on the underlying host operating system.\nSuccessful exploitation of this flaw can result in full system compromise, unauthorized access to sensitive data, and potential lateral movement within the network infrastructure.\nThe attack can be launched remotely over the network against exposed management interfaces without requiring prior authentication or specific privileges, depending on the network exposure of the target system.\nPublicly available exploit code increases the risk of active exploitation by malicious actors, necessitating immediate defensive measures and remediation.",
  "technicalDetails": "The vulnerability stems from improper neutralization of special elements used in an operating system command, characteristic of CWE-78 (OS Command Injection).\nThe affected component is the Management API implemented in the Go programming language, specifically inside the shellExecCommand function within the core/engine.go file.\nThe root cause is the direct or improperly sanitized concatenation or passage of user-supplied input from the exec argument into system shell execution routines without adequate input validation, escaping, or parameterization.\nThe attack flow begins when an unauthenticated remote attacker sends a specially crafted HTTP request or API call to the Management API endpoint that interfaces with the vulnerable shellExecCommand function.\nThe attacker injects malicious shell metacharacters or command separators (such as semicolons, pipes, or backticks) combined with system commands into the exec parameter.\nBecause the core/engine.go logic fails to validate or sanitize the input before passing it to the underlying OS shell interpreter, the injected commands are executed with the privileges of the running cc-connect process.\nNetwork exposure is high due to the remote accessibility of the Management API. Authentication and privilege requirements are minimal or absent, enabling external unauthenticated threat actors to achieve remote code execution.\nPost-exploitation impact includes complete takeover of the host running the cc-connect service, data exfiltration, installation of backdoors, and potential pivot points into internal network segments."
}