{"id":"CVE-2026-107202","revision":"12eae1005df34ee4a0464a6d8093a5f3","records":[{"revision":"12eae1005df34ee4a0464a6d8093a5f3","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-107202","aliases":[],"title":"CVE-2026-107202","description":"A command injection vulnerability exists in the h-ui (version v0.0.25 and below) administrative API due to improper validation of the listen configuration field. When an authenticated administrator submits a value containing shell metacharacters, the application constructs nftables/iptables rule strings using fmt.Sprintf and executes them via bash -c as root. Because the listen field lacks port or format validation, arbitrary OS commands can be injected and executed with root privileges.","state":0,"publishedAt":"2026-10-07T14:26:49.905+00:00","modifiedAt":"2026-10-07T20:39:57.719+00:00","affected":[{"ecosystem":"Vendor product","name":"h-ui","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"jonssonyan\",\n                    \"product\": \"h-ui\",\n                    \"versions\": [\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"0.0.25\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://github.com/jonssonyan/h-ui"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-107202","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-107202","identifiers":["CVE-2026-107202"]},"retained":false,"historicalAffected":[]}],"coverage":[]}