{"id":"CVE-2026-104584","aliases":["EUVD-2026-100470","GHSA-54m7-7mmj-vwxc"],"status":"published","title":"reNgine up to v2.2.0 and current master branch (commit de4199222cca5618f1255930ce78987e47d43a99)...","description":"reNgine up to v2.2.0 and current master branch (commit de4199222cca5618f1255930ce78987e47d43a99) is vulnerable to OS Command Injection via the custom_headers scan engine configuration field in web/reNgine/tasks.py (fetch_url and dir_file_fuzz functions).","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.01594,"percentile":0.7603,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-78"],"published":"2026-10-13T00:00:00Z","modified":"2026-10-28T02:31:12Z","exploits":[{"source":"pocgithub","id":"AmalJafarzade/CVE-2026-104584","title":"AmalJafarzade/CVE-2026-104584","date":"2026-10-09","url":"https://github.com/AmalJafarzade/CVE-2026-104584"}],"references":[{"url":"https://github.com/yogeshojha/rengine","tags":["package"]},{"url":"https://github.com/AmalJafarzade/CVE-2026-104584","tags":["exploit","package"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104584","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-54m7-7mmj-vwxc"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/104xxx/CVE-2026-104584.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-104584","description":"reNgine up to v2.2.0 and current master branch (commit de4199222cca5618f1255930ce78987e47d43a99) is vulnerable to OS Command Injection via the custom_headers scan engine configuration field in web/reNgine/tasks.py (fetch_url and dir_file_fuzz functions).","status":"published","published":"2026-10-13T00:00:00Z","modified":"2026-10-19T18:43:09.621Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:20:09.448255Z"}],"euvd":[{"id":"EUVD-2026-100470","description":"reNgine up to v2.2.0 and current master branch (commit de4199222cca5618f1255930ce78987e47d43a99) is vulnerable to OS Command Injection via the custom_headers scan engine configuration field in web/reNgine/tasks.py (fetch_url and dir_file_fuzz functions).","status":"published","published":"2026-10-13T00:00:00Z","modified":"2026-10-19T18:43:09Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T16:59:49.097498Z"}],"ghsa":[{"id":"GHSA-54m7-7mmj-vwxc","title":"reNgine up to v2.2.0 and current master branch (commit de4199222cca5618f1255930ce78987e47d43a99)...","description":"reNgine up to v2.2.0 and current master branch (commit de4199222cca5618f1255930ce78987e47d43a99) is vulnerable to OS Command Injection via the custom_headers scan engine configuration field in web/reNgine/tasks.py (fetch_url and dir_file_fuzz functions).","status":"published","published":"2026-10-13T21:33:07Z","modified":"2026-10-19T21:37:01Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T15:14:01.813939Z"}],"nvd":[{"id":"CVE-2026-104584","description":"reNgine up to v2.2.0 and current master branch (commit de4199222cca5618f1255930ce78987e47d43a99) is vulnerable to OS Command Injection via the custom_headers scan engine configuration field in web/reNgine/tasks.py (fetch_url and dir_file_fuzz functions).","status":"published","published":"2026-10-13T19:17:55.417Z","modified":"2026-10-19T19:17:18.8Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:12:57.132005Z"}],"osv":[{"id":"CVE-2026-104584","description":"reNgine up to v2.2.0 and current master branch (commit de4199222cca5618f1255930ce78987e47d43a99) is vulnerable to OS Command Injection via the custom_headers scan engine configuration field in web/reNgine/tasks.py (fetch_url and dir_file_fuzz functions).","status":"published","published":"2026-10-13T00:00:00Z","modified":"2026-10-28T02:31:12.130480838Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:54.236592Z"}]}}