CVE-2026-51190 Command injection in n/a
Attacker-controlled arguments in the Serverless Devs CLI 's init' command allow OS command injection via shell execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-51190?
CVE-2026-51190 is a critical command injection vulnerability in n/a, published on 3 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The "s init" command in Serverless-Devs @serverless-devs/s <= 3.1.11 passes unsanitized user input to child_process.spawn() with shell: true. A URL ending in ".git" bypasses the only input check, allowing OS command injection when a user runs "s init" with an attacker-controlled argument.
Weakness: CWE-78
Which versions are affected by CVE-2026-51190?
How do I fix CVE-2026-51190?
No fix has been published for CVE-2026-51190 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-51190 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-51190 exists.
Sources
Also known as GHSA-rm7q-w9c9-27rj.