Os-Command-Injection — CraftedSignal Threat Feed

SambaBox OS Command Injection Vulnerability (CVE-2026-3120)

hello@craftedsignal.io — Mon, 04 May 2026 12:16:29 +0000

CVE-2026-3120 is a critical vulnerability affecting SambaBox, a product by Profelis Information and Consulting Trade and Industry Limited Company. This vulnerability, categorized as an Improper Control of Generation of Code (‘Code Injection’), allows for OS Command Injection. Specifically, SambaBox versions 5.1 up to (but not including) version 5.3 are affected. An attacker with high privileges can exploit this vulnerability to execute arbitrary commands on the underlying operating system, potentially leading to full system compromise. This vulnerability was reported by the Computer Emergency Response Team of the Republic of Turkey (USOM). Defenders should patch affected systems immediately or apply mitigations to prevent exploitation.

Attack Chain

An attacker with high privileges gains access to the SambaBox management interface.
The attacker crafts a malicious request containing an OS command within a vulnerable input field.
The SambaBox application fails to properly sanitize or validate the input.
The application generates code incorporating the unsanitized input.
The generated code is executed by the underlying operating system.
The injected OS command is executed with the privileges of the SambaBox application.
The attacker gains the ability to execute arbitrary commands on the server.
The attacker leverages the command execution to achieve persistence, escalate privileges further, or exfiltrate sensitive data.

Impact

Successful exploitation of CVE-2026-3120 allows an attacker to execute arbitrary commands on the SambaBox server. This could lead to complete system compromise, including data theft, modification, or destruction. The vulnerability affects SambaBox installations from version 5.1 before 5.3, potentially impacting all organizations using these versions. Given the high CVSS score of 7.2, this vulnerability poses a significant risk.

Recommendation

Upgrade SambaBox to version 5.3 or later to patch CVE-2026-3120.
Apply the following Sigma rule to detect potential exploitation attempts by monitoring for suspicious process execution: “Detect SambaBox Command Injection”.
Monitor web server logs for unusual requests targeting SambaBox applications, specifically looking for attempts to inject OS commands.

PraisonAI OS Command Injection Vulnerability (CVE-2026-34937)

hello@craftedsignal.io — Fri, 03 Apr 2026 23:17:06 +0000

PraisonAI, a multi-agent teams system, is susceptible to an OS command injection vulnerability affecting versions prior to 1.5.90. The vulnerability, identified as CVE-2026-34937, stems from the run_python() function’s construction of shell command strings. This function interpolates user-controlled code into a python3 -c "" command and executes it using subprocess.run(..., shell=True). The inadequate escaping logic, specifically the failure to escape $() and backtick substitutions, enables arbitrary OS command execution prior to Python’s invocation. Users of PraisonAI are urged to upgrade to version 1.5.90 or later to mitigate this risk.


Attack Chain

An attacker identifies an instance of PraisonAI running a version prior to 1.5.90.
The attacker crafts malicious code containing OS command injection payloads using $() or backticks.
The attacker injects the malicious code into a parameter or input field that is processed by the run_python() function.
The run_python() function constructs the shell command string, interpolating the attacker’s malicious code without proper escaping.
The subprocess.run() function executes the crafted shell command with shell=True.
The attacker’s OS command is executed on the host system with the privileges of the PraisonAI application.
The attacker gains unauthorized access to the system, potentially enabling data exfiltration, system modification, or denial of service.

Impact
Successful exploitation of this vulnerability (CVE-2026-34937) allows an attacker to execute arbitrary OS commands on the system running PraisonAI. This could lead to complete system compromise, data breaches, or denial of service. The severity is high because it allows unauthenticated or low-privileged users to gain complete control of the system. Organizations using affected versions of PraisonAI are at risk of significant data loss and reputational damage.
Recommendation

Immediately upgrade PraisonAI to version 1.5.90 or later to patch CVE-2026-34937.
Deploy the Sigma rule “Detect PraisonAI OS Command Injection Attempt” to your SIEM to identify potential exploitation attempts.
Monitor process creation events for the execution of unexpected processes originating from the PraisonAI application to detect post-exploitation activity.



Ruckus Unleashed Authenticated Remote Code Execution via CVE-2023-7338
hello@craftedsignal.io — Thu, 26 Mar 2026 20:16:08 +0000
CVE-2023-7338 is a critical remote code execution (RCE) vulnerability found in Ruckus Unleashed, a Wi-Fi network management solution. The vulnerability resides within the web-based management interface and requires the affected system to be operating in gateway mode. An authenticated attacker can exploit this flaw by crafting and sending malicious requests to the management interface, resulting in arbitrary code execution on the device. This vulnerability was reported by VulnCheck and assigned…


Pardus OS My Computer OS Command Injection Vulnerability (CVE-2026-6849)
hello@craftedsignal.io — Tue, 02 Jan 2024 12:00:00 +0000
CVE-2026-6849 is a critical vulnerability affecting Pardus OS My Computer, a software developed by TUBITAK BILGEM Software Technologies Research Institute. This OS Command Injection vulnerability exists in versions <=0.7.5 and before 0.8.0. The vulnerability stems from the improper neutralization of special elements used in OS commands, potentially allowing an attacker to inject and execute arbitrary commands on the underlying operating system. Successful exploitation could lead to complete system compromise, data exfiltration, or denial-of-service conditions. Defenders should prioritize patching affected systems and implementing detection measures to identify and prevent exploitation attempts.
Attack Chain

Attacker identifies an input field within Pardus OS My Computer that is vulnerable to OS command injection.
The attacker crafts a malicious input string containing special elements designed to be interpreted as OS commands.
The vulnerable software fails to properly sanitize or neutralize these special elements.
The software passes the unsanitized input string to an OS command interpreter (e.g., system(), exec()).
The OS command interpreter executes the attacker’s injected commands with the privileges of the running application.
The attacker gains arbitrary code execution on the server.
The attacker uses the gained access to install malware, exfiltrate sensitive data, or perform other malicious actions.

Impact
Successful exploitation of CVE-2026-6849 can lead to a complete compromise of the affected Pardus OS My Computer system. This could allow attackers to gain unauthorized access to sensitive data, install malware, disrupt services, or pivot to other systems on the network. Given the critical nature of OS command injection vulnerabilities, organizations using affected versions of Pardus OS My Computer should prioritize patching and mitigation efforts.
Recommendation

Upgrade Pardus OS My Computer to version 0.8.0 or later to patch CVE-2026-6849.
Deploy the Sigma rule Detect Suspicious Pardus OS My Computer Processes to your SIEM to detect potential exploitation attempts via process creation.