CVE-2026-118477
The ei_git_repo_url parameter in the Git remote configuration endpoint of KaliFast is vulnerable to…
- Risk score
- 64/100
- CVSS
- 9.8 v3.1
- Published
- 28 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- The ei_git_repo_url parameter in KaliFast's Git remote configuration endpoint is vulnerable to OS Command Injection, allowing an authenticated attacker to execute arbitrary commands on the server with www-data privileges.
- Affected
- {'product': 'KaliFast', 'version': 'all versions prior to 2026061802'}
- Fix
- Upgrade to version 2026061802 or later
- Exploitation
- No known exploitation
Why it is Amber
- CVSS 9.8 critical
- Remotely exploitable without logging in
References
Original description
The ei_git_repo_url parameter in the Git remote configuration endpoint of KaliFast is vulnerable to OS Command Injection. This OS Command Injection vulnerability allows an authenticated attacker (free registration available) to execute arbitrary commands on the KaliFast server with www-data privileges. Fixed in version 2026061802.
Last activity 28 Oct 2026. Patch Forecast updates every hour.