Remote Command Injection in SabyasachiRana WebMap

CVE-2026-90843 describes a critical remote code execution vulnerability identified in the SabyasachiRana WebMap application. The vulnerability exists within the nmap_newscan function, located in the functions_nmap.py file. It is caused by improper sanitization of the target/params argument, which is passed directly to system-level calls. An attacker can exploit this by submitting crafted input to the target or parameters field of the New Nmap Scan Handler, enabling them to execute arbitrary OS commands on the host server. The vulnerability is exploitable remotely without authentication. Public disclosure of the exploit has increased the likelihood of active exploitation. Organizations using versions of WebMap up to commit 8b95fe4dc301a3c09ddf145b895de0bf9f8d2a25 should immediately apply the vendor-provided patch 3d52f65803a2716bff14d938352c6fef45b0cfb6 to mitigate this risk.

Attack Chain

1. Attacker identifies a target running a vulnerable version of SabyasachiRana WebMap exposed to the internet.
2. Attacker probes the application to locate the New Nmap Scan Handler feature.
3. Attacker crafts an HTTP request targeting the functionality served by functions_nmap.py.
4. Attacker injects malicious OS command syntax into the target or params argument fields.
5. The application passes the unsanitized input to the nmap_newscan function.
6. The underlying OS executes the attacker-supplied command with the privileges of the WebMap service.
7. Attacker achieves remote code execution for potential post-exploitation activities.

Impact

Successful exploitation allows for full remote command execution on the host server, potentially leading to unauthorized data exfiltration, internal network lateral movement, or complete system compromise. The vulnerability affects all users of the WebMap project prior to the application of the specified security patch.

Recommendation

• Upgrade the WebMap application to at least commit 3d52f65803a2716bff14d938352c6fef45b0cfb6 immediately.
• Audit webserver access logs for POST requests directed at endpoints associated with the New Nmap Scan Handler containing shell metacharacters such as semicolon, pipe, or backticks in the request body.
• Implement strict input validation on the application front-end for all target and parameter fields passed to scanning components.
• Restrict network access to the WebMap administrative interface to trusted IP addresses only.