{"id":"CVE-2023-50094","aliases":["EUVD-2023-54924","GHSA-fx7f-f735-vgh4","GHSA-vfhc-4q79-wvf9"],"status":"published","title":"reNgine through 2.0.2 allows OS Command Injection if an adversary has a valid session ID. The...","description":"reNgine before 2.1.2 allows OS Command Injection if an adversary has a valid session ID. The attack places shell metacharacters in an api/tools/waf_detector/?url= string. The commands are executed as root via subprocess.check_output.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.1354,"percentile":0.96502,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-78"],"published":"2024-01-01T00:00:00Z","modified":"2026-10-28T02:30:27Z","exploits":[{"source":"nuclei","id":"CVE-2023-50094","title":"reNgine 2.2.0 - Command Injection","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-50094.yaml"},{"source":"pocgithub","id":"Zierax/CVE-2023-50094_POC","title":"Zierax/CVE-2023-50094_POC","date":"2024-11-23","url":"https://github.com/Zierax/CVE-2023-50094_POC"}],"products":[{"vendor":"yogeshojha","product":"rengine"}],"references":[{"url":"https://github.com/yogeshojha/rengine/blob/5e120bd5f9dfbd1da82a193e8c9702e483d38d22/web/api/views.py#L195","tags":["x_transferred","Product","web"]},{"url":"https://github.com/yogeshojha/rengine/security","tags":["x_transferred","Product","web"]},{"url":"https://github.com/yogeshojha/rengine/releases","tags":["x_transferred","Release Notes","package"]},{"url":"https://www.mattz.io/posts/cve-2023-50094/","tags":["x_transferred","Exploit","Third Party Advisory","web"]},{"url":"https://github.com/yogeshojha/rengine/security/advisories/GHSA-fx7f-f735-vgh4","tags":["advisory"]},{"url":"https://github.com/yogeshojha/rengine/commit/3d5f1724dd12cf9861443742e7d7c02ff8c75a6f","tags":["fix"]},{"url":"https://github.com/yogeshojha/rengine/commit/edd3c85ee16f93804ad38dac5602549d2d30a93e","tags":["fix"]},{"url":"https://github.com/yogeshojha/rengine/blob/53d9f505f04861a5040195ea71f20907ff90577a/web/api/views.py#L268-L275","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-50094","tags":["advisory"]},{"url":"https://www.mattz.io/posts/cve-2023-50094"},{"url":"https://github.com/advisories/GHSA-vfhc-4q79-wvf9"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/50xxx/CVE-2023-50094.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-50094","description":"reNgine before 2.1.2 allows OS Command Injection if an adversary has a valid session ID. The attack places shell metacharacters in an api/tools/waf_detector/?url= string. The commands are executed as root via subprocess.check_output.","status":"published","published":"2024-01-01T00:00:00Z","modified":"2025-04-17T18:55:32.44Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:35:34.55015Z"}],"euvd":[{"id":"EUVD-2023-54924","description":"reNgine before 2.1.2 allows OS Command Injection if an adversary has a valid session ID. The attack places shell metacharacters in an api/tools/waf_detector/?url= string. The commands are executed as root via subprocess.check_output.","status":"published","published":"2024-01-01T00:00:00Z","modified":"2025-04-17T18:55:32Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T20:52:20.597725Z"}],"ghsa":[{"id":"GHSA-vfhc-4q79-wvf9","title":"reNgine through 2.0.2 allows OS Command Injection if an adversary has a valid session ID. The...","description":"reNgine through 2.0.2 allows OS Command Injection if an adversary has a valid session ID. The attack places shell metacharacters in an api/tools/waf_detector/?url= string. The commands are executed as root via subprocess.check_output.","status":"published","published":"2024-01-01T18:30:25Z","modified":"2024-08-14T18:32:36Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:57:58.12356Z"}],"nvd":[{"id":"CVE-2023-50094","description":"reNgine before 2.1.2 allows OS Command Injection if an adversary has a valid session ID. The attack places shell metacharacters in an api/tools/waf_detector/?url= string. The commands are executed as root via subprocess.check_output.","status":"published","published":"2024-01-01T18:15:09.13Z","modified":"2026-06-17T06:39:09.85Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:08:59.830468Z"}],"osv":[{"id":"CVE-2023-50094","description":"reNgine before 2.1.2 allows OS Command Injection if an adversary has a valid session ID. The attack places shell metacharacters in an api/tools/waf_detector/?url= string. The commands are executed as root via subprocess.check_output.","status":"published","published":"2024-01-01T00:00:00Z","modified":"2026-10-28T02:30:27.8393199Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:34.72355Z"}]}}