CVE-2026-26462 Code injection in n/a
Remote attackers can execute arbitrary OS commands via JavaScript injection due to insecure Electron renderer configuration in the hospital management system.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-26462?
CVE-2026-26462 is a high-severity code injection vulnerability in n/a, published on 18 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Offline Hospital Management System 5.3.0 allows remote code execution due to an improper Electron renderer configuration. The application enables Node.js integration while disabling context isolation, allowing JavaScript executed in the renderer process to access Node.js APIs and execute arbitrary operating system commands.
Weakness: CWE-917
Which versions are affected by CVE-2026-26462?
How do I fix CVE-2026-26462?
No fix has been published for CVE-2026-26462 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-26462 being exploited?
There is no known exploitation of CVE-2026-26462 in the wild and no public exploit code.
Sources
Also known as GHSA-53vh-ccq9-xwq5.