CVE-2026-90843 SabyasachiRana WebMap New Nmap Scan functions_nmap.py nmap_newscan os command injection
Remote attackers can execute arbitrary OS commands via the nmap_newscan function in WebMap, requiring a patch to remediate.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-90843?
CVE-2026-90843 is a medium-severity command injection vulnerability in SabyasachiRana WebMap, published on 15 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A security vulnerability has been detected in SabyasachiRana WebMap up to 8b95fe4dc301a3c09ddf145b895de0bf9f8d2a25. This affects the function nmap_newscan of the file functions_nmap.py of the component New Nmap Scan Handler. Such manipulation of the argument target/params leads to os command injection. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The name of the patch is 3d52f65803a2716bff14d938352c6fef45b0cfb6. A patch should be applied to remediate this issue. This issue got fixed with a silent patch.
Which versions are affected by CVE-2026-90843?
How do I fix CVE-2026-90843?
No fix has been published for CVE-2026-90843 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-90843 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-90843 exists.
Sources
Also known as GHSA-pp25-fxhh-fhqj.