CVE-2026-11408 vertex-app vertex Log Viewer Endpoint LogMod.js os command injection
Remote attackers can execute arbitrary OS commands via the Log Viewer Endpoint in vertex-app vertex, requiring a patch to mitigate.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-11408?
CVE-2026-11408 is a medium-severity command injection vulnerability in vertex-app vertex, published on 6 Jun 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A vulnerability was identified in vertex-app vertex up to 2026.02.12. This issue affects some unknown processing of the file app/model/LogMod.js of the component Log Viewer Endpoint. Such manipulation of the argument req.query leads to os command injection. The attack can be executed remotely. The exploit is publicly available and might be used. The name of the patch is 805d82e7100d49b79b3beb1b9420e8e458987198. It is best practice to apply a patch to resolve this issue.
Which versions are affected by CVE-2026-11408?
How do I fix CVE-2026-11408?
No fix has been published for CVE-2026-11408 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-11408 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-11408 exists.
Sources
Also known as GHSA-cx7v-5xwm-4mqw.