CVE-2026-107202 CVE-2026-107202
Authenticated administrators can inject OS commands via the listen field in h-ui, leading to root code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-107202?
CVE-2026-107202 is a critical command injection vulnerability in jonssonyan h-ui, published on 7 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A command injection vulnerability exists in the h-ui (version v0.0.25 and below) administrative API due to improper validation of the listen configuration field. When an authenticated administrator submits a value containing shell metacharacters, the application constructs nftables/iptables rule strings using fmt.Sprintf and executes them via bash -c as root. Because the listen field lacks port or format validation, arbitrary OS commands can be injected and executed with root privileges.
Weakness: CWE-77
Which versions are affected by CVE-2026-107202?
How do I fix CVE-2026-107202?
No fix has been published for CVE-2026-107202 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-107202 being exploited?
There is no known exploitation of CVE-2026-107202 in the wild and no public exploit code.
Sources
Also known as GHSA-qrj2-qqx7-wqxq.