PT-2026-28396 · Axon Code · Axon Code
Publicado
2025-12-15
·
Atualizado
2026-03-29
·
CVE-2026-30303
CVSS v2.0
10
Crítica
| Vetor | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Axon Code (affected versions not specified)
Description
The command auto-approval module contains an OS Command Injection issue, bypassing its whitelist security mechanism. This is due to the use of an incompatible command parser (the Unix-based shell-quote library) on the Windows platform and a failure to correctly handle Windows CMD-specific escape sequences (^). An attacker can exploit this by crafting payloads such as
git log ^" & malicious command ^", deceiving the parser and causing the Windows CMD interpreter to execute the malicious command, leading to arbitrary Remote Code Execution (RCE). The parser incorrectly interprets the malicious command connector (&) as being within a protected string argument.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
OS Command Injection
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Axon Code