CVE-2026-39054

Deeper analysis

Oinone Pamirs version 7.0.0 is affected by a command injection vulnerability in the CommandHelper.executeCommands method. The code launches a shell process and passes attacker-supplied strings directly to its standard input without any sanitization or validation, enabling arbitrary operating system command execution. The issue is tracked as CWE-77 and carries a CVSS 3.1 score of 7.3 reflecting network-accessible, low-complexity exploitation that requires no authentication or user interaction.

An unauthenticated remote attacker can invoke the affected method with crafted input to execute arbitrary commands on the underlying operating system. Successful exploitation grants the ability to read, modify, or delete data and potentially pivot within the affected environment.

The associated GitHub repository and changelog reference provide the primary sources for version history and any subsequent updates, while a public gist illustrates the injection vector. The EPSS score has remained flat at 0.0280 with no observed increase since disclosure.