CVE-2026-110392
9.8CriticalPublished 14 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-78
Impact
Remote, unauthenticated attackers can execute arbitrary OS commands on the host running the QA-Board service over the network. They achieve full system compromise without needing credentials or user interaction.
Root cause
The application fails to neutralize special elements before passing untrusted input directly into an OS command.
Affected systems
Versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Fix & remediation
Apply commit 05789e67c5d022f2403b9340fc8d82dc99dc3707 from the upstream Samsung/qaboard repository. As an interim mitigation, restrict network access to the QA-Board service using firewall rules or take the instance offline.
$ git pull origin masterAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Samsung Open Source QA-Board allows : OS Command Injection.