PT-2026-7898 · Arduino · Arduino-App-Lab

Ottimo + 1 · Publicado 2026-02-12 · Atualizado 2026-02-19 · CVE-2026-25933

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Média

Vetor base

AV:P/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Arduino App Lab versions prior to 0.4.0

Description Arduino App Lab, a cross-platform IDE for developing Arduino Apps, contains a flaw in its Terminal component. Insufficient input sanitization and validation of data received from connected hardware devices, specifically in the info.Serial and info.Address metadata fields, allows for potential code execution. An attacker requires physical access to a compromised board to supply crafted strings containing shell metacharacters. These crafted strings are then executed with the privileges of the user running the application when the host system processes the fields.

Recommendations Update to version 0.4.0 or later.

Exploit

Correção

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

CVE-2026-25933

GHSA-3652-939F-F7G4

Produtos afetados

Arduino-App-Lab

Referências · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25933.json · Exploit
• https://github.com/arduino/arduino-app-lab/releases/tag/al-0.4.0 · Nota
• https://github.com/arduino/arduino-app-lab/security/advisories/GHSA-3652-939f-f7g4 · Aviso do Fabricante
• https://t.me/cveNotify/152527 · Publicação no Telegram
• https://twitter.com/CVEnew/status/2022053681252749549 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-25933 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2026-25933 · Aviso do Fabricante