GCVE-110-VULN-GO-2026-000463

Advisory PublishedCVSS 4.2/10

Vulnetix · Advisory published October 22, 2026

[GO-EXEC-SHELL] exec.Command invoking a shell with -c (arbitrary command execution) — matched: prog := exec.Command("sh", "-c", cmd)

Weaknesses (CWE)

CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CVSS 3.1

4.2/10

Medium · CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L

Vendor	Product	Versions	Platforms
go	github.com/knight42/yuki	0.7.1 (affected)	—

advisory

web

Investigate this vulnerability in the interactive console or download the raw GCVE record.