CVE-2021-47851 Mini Mouse 9.2.0 - Remote Code Execution

Critical 9.3 Published 21 Jan 2026 Updated 22 Jan 2026

Attackers can execute arbitrary commands via an unauthenticated HTTP endpoint in Mini Mouse, leading to remote code execution.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2021-47851?

CVE-2021-47851 is a critical command injection vulnerability in Yodinfo Mini Mouse, published on 21 Jan 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Mini Mouse 9.2.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary commands through an unauthenticated HTTP endpoint. Attackers can leverage the /op=command endpoint to download and execute payloads by sending crafted JSON requests with malicious script commands.

Weakness: CWE-78

Which versions are affected by CVE-2021-47851?

It affects 1 product.

Products include Yodinfo Mini Mouse.

How do I fix CVE-2021-47851?

No fix has been published for CVE-2021-47851 yet. Limit exposure of the affected software until one is available.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2021-47851 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2021-47851 exists.

Sources

Also known as GHSA-wqgq-6v9c-p5pw.