CVE-2026-108941
4.8MediumPublished 13 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
- Impact
- Limited impact
- Weakness
- CWE-74, CWE-94
Impact
A local attacker with low privileges can execute arbitrary code by getting a user to process malicious configuration arguments. Local environment access and user interaction are required.
Root cause
The parse_cfg_args function in internal/utils/common.py fails to properly sanitize the cfg_args input, permitting code injection.
Affected systems
Linketic CityGaussian up to 2.0
CVSS v3.1 · CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
Fix & remediation
No official patch is currently available from the vendor. Mitigate risk by not running untrusted configuration arguments or sidecar configurations, and restrict access to the CityGaussian execution environment.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A vulnerability was identified in Linketic CityGaussian up to 2.0. This affects the function parse_cfg_args of the file internal/utils/common.py of the component Sidecar Parsing. The manipulation of the argument cfg_args leads to code injection. The attack can only be performed from a local environment. The project was informed of the problem early through an issue report but has not responded yet.