PT-2026-27217 · Blinko · Blinko

Tx1Ee · Publicado 2026-03-23 · Atualizado 2026-03-23 · CVE-2026-23882

Positive Technologies (AI Summary)

CVSS v4.0

8.6

Alta

Vetor base

AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Blinko versions prior to 1.8.4

Description Blinko is an AI-powered card note-taking project. The server creation function for the Model Context Protocol (MCP) allows specification of arbitrary commands and arguments. These commands are executed during connection testing. This allows for potential remote code execution.

Recommendations Update to version 1.8.4 or later.

Exploit

Correção

RCE

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

CVE-2026-23882

GHSA-59R2-82P8-C56V

Produtos afetados

Blinko

Referências · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23882.json · Exploit
• https://github.com/blinkospace/blinko/commit/bef6b770743e87c630db2d00d7049dabd96bfe85 · Correção
• https://github.com/blinkospace/blinko/security/advisories/GHSA-59r2-82p8-c56v · Aviso do Fabricante
• https://github.com/blinkospace/blinko/releases/tag/1.8.4 · Nota
• https://twitter.com/CveFindCom/status/2036189286886694975 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-23882 · Nota de Segurança
• https://twitter.com/cyberbivash/status/2036206819803119674 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-23882 · Aviso do Fabricante