PT-2026-22131 · Zen C · Zen-C

F0Nduesav0Yarde · Published 2026-02-26 · Updated 2026-05-01 · CVE-2026-28207

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Zen C versions prior to 0.4.2

Description A command injection issue exists in the Zen C compiler. Prior to version 0.4.2, a local attacker can execute arbitrary shell commands by providing a specially crafted output filename via the -o command-line argument. The issue resided in the main application logic, specifically in src/main.c, where the compiler constructed a shell command string using the system() function. The system() function invoked a shell, interpreting shell metacharacters within the output filename, leading to arbitrary command execution. The vulnerable component is the system() function. The attacker needs to influence the command-line arguments passed to the zc compiler.

Recommendations Update to Zen C version 0.4.2 or later.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-28207

GHSA-9RFF-X96H-76H2

Affected Products

Zen-C

References · 9

• 🔥 https://github.com/z-libs/Zen-C/security/advisories/GHSA-9rff-x96h-76h2 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28207.json · Exploit
• 🔥 https://f0nduesav0yarde.github.io/blog/vulnerabilities/cve-2026-28207 · Exploit
• https://osv.dev/vulnerability/CVE-2026-28207 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-28207 · Security Note
• https://twitter.com/CVEnew/status/2027466643048480813 · Twitter Post
• https://twitter.com/zuhaitz_dev/status/2026868253461488035 · Twitter Post
• https://t.me/cveNotify/161730 · Telegram Post
• https://t.me/cveNotify/153836 · Telegram Post