{"id":"CVE-2024-36360","aliases":["EUVD-2024-36029","GHSA-7m6w-cvrv-x8wx"],"status":"published","title":"OS command injection vulnerability exists in awkblog v0.0.1 (commit hash...","description":"OS command injection vulnerability exists in awkblog v0.0.1 (commit hash:7b761b192d0e0dc3eef0f30630e00ece01c8d552) and earlier. If a remote unauthenticated attacker sends a specially crafted HTTP request, an arbitrary OS command may be executed with the privileges of the affected product on the machine running the product.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.01571,"percentile":0.75568,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-78"],"published":"2024-06-11T04:19:39Z","modified":"2026-06-17T07:36:34Z","products":[{"vendor":"keisuke nakayama","product":"awkblog"},{"vendor":"keisuke_nakayama","product":"awkblog"}],"references":[{"url":"https://github.com/yammerjp/awkblog/issues/1","tags":["x_transferred"]},{"url":"https://jvn.jp/en/jp/JVN80506242/","tags":["x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-36360"},{"url":"https://jvn.jp/en/jp/JVN80506242"},{"url":"https://github.com/advisories/GHSA-7m6w-cvrv-x8wx"}],"sources":{"cve":[{"id":"CVE-2024-36360","description":"OS command injection vulnerability exists in awkblog v0.0.1 (commit hash:7b761b192d0e0dc3eef0f30630e00ece01c8d552) and earlier. If a remote unauthenticated attacker sends a specially crafted HTTP request, an arbitrary OS command may be executed with the privileges of the affected product on the machine running the product.","status":"published","published":"2024-06-11T04:19:39.122Z","modified":"2025-03-14T14:43:00.422Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:34:14.985673Z"}],"euvd":[{"id":"EUVD-2024-36029","description":"OS command injection vulnerability exists in awkblog v0.0.1 (commit hash:7b761b192d0e0dc3eef0f30630e00ece01c8d552) and earlier. If a remote unauthenticated attacker sends a specially crafted HTTP request, an arbitrary OS command may be executed with the privileges of the affected product on the machine running the product.","status":"published","published":"2024-06-11T04:19:39Z","modified":"2025-03-14T14:43:00Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T20:53:03.250545Z"}],"ghsa":[{"id":"GHSA-7m6w-cvrv-x8wx","title":"OS command injection vulnerability exists in awkblog v0.0.1 (commit hash...","description":"OS command injection vulnerability exists in awkblog v0.0.1 (commit hash:7b761b192d0e0dc3eef0f30630e00ece01c8d552) and earlier. If a remote unauthenticated attacker sends a specially crafted HTTP request, an arbitrary OS command may be executed with the privileges of the affected product on the machine running the product.","status":"published","published":"2024-06-11T06:31:46Z","modified":"2025-03-14T15:33:00Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T15:00:17.214914Z"}],"nvd":[{"id":"CVE-2024-36360","description":"OS command injection vulnerability exists in awkblog v0.0.1 (commit hash:7b761b192d0e0dc3eef0f30630e00ece01c8d552) and earlier. If a remote unauthenticated attacker sends a specially crafted HTTP request, an arbitrary OS command may be executed with the privileges of the affected product on the machine running the product.","status":"published","published":"2024-06-11T05:15:53.61Z","modified":"2026-06-17T07:36:34.447Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:10:04.804473Z"}]}}