GHSA-rwr9-9r33-h7x4

GHSA-rwr9-9r33-h7x4 PUBLISHED CVSS 7.199999809265137 HIGH

Record from GitHub Advisory Database · Published February 21, 2026

Nagios Host monitoringwizard Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Nagios Host. Authentication is required to exploit this vulnerability. The specific flaw exists within the monitoringwizard module. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-28245.

Risk scores

CVSS 3.0

7.199999809265137

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Timeline

Feb 21, 2026 CVE Published
Mar 10, 2026 Security Advisory (4 in total, the first dated here)

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln GHSA-rwr9-9r33-h7x4
vulnetix vdb fixes GHSA-rwr9-9r33-h7x4

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/GHSA-rwr9-9r33-h7x4/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

Look up in the Resolve Platform →