{"id":"CVE-2024-28886","aliases":["EUVD-2024-34432"],"status":"published","description":"OS command injection vulnerability exists in UTAU versions prior to v0.4.19. If a user of the product opens a crafted UTAU project file (.ust file), an arbitrary OS command may be executed.","severity":{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00663,"percentile":0.5217,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-94"],"published":"2024-05-28T03:11:18Z","modified":"2026-06-17T07:21:58Z","products":[{"vendor":"ameya/ayame","product":"utau"},{"vendor":"ameya_ayame","product":"utau"}],"references":[{"url":"https://utau2008.xrea.jp/","tags":["x_transferred"]},{"url":"https://jvn.jp/en/jp/JVN71404925/","tags":["x_transferred"]}],"sources":{"cve":[{"id":"CVE-2024-28886","description":"OS command injection vulnerability exists in UTAU versions prior to v0.4.19. If a user of the product opens a crafted UTAU project file (.ust file), an arbitrary OS command may be executed.","status":"published","published":"2024-05-28T03:11:18.648Z","modified":"2024-08-02T01:03:50.258Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:34:18.951288Z"}],"euvd":[{"id":"EUVD-2024-34432","description":"OS command injection vulnerability exists in UTAU versions prior to v0.4.19. If a user of the product opens a crafted UTAU project file (.ust file), an arbitrary OS command may be executed.","status":"published","published":"2024-05-28T03:11:18Z","modified":"2024-08-02T01:03:50Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T03:50:26.166982Z"}],"nvd":[{"id":"CVE-2024-28886","description":"OS command injection vulnerability exists in UTAU versions prior to v0.4.19. If a user of the product opens a crafted UTAU project file (.ust file), an arbitrary OS command may be executed.","status":"published","published":"2024-05-28T03:15:08.47Z","modified":"2026-06-17T07:21:58.13Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:10:02.520903Z"}]}}