PT-2026-22735 · Ccurtsinger · Stabilizer

Published 2026-03-03 · Updated 2026-03-03 · CVE-2025-52365

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ccurtsinger/stabilizer (affected versions not specified)

Description A command injection issue exists in the szc script of the ccurtsinger/stabilizer repository. This allows remote attackers to execute arbitrary system commands through unsanitized user input. The issue stems from the direct concatenation of command-line arguments into shell commands without proper validation, specifically using the os.system() function. The os.system() function executes system commands, and when combined with unsanitized input, it can lead to the execution of unintended commands. The vulnerable component is the szc script.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2025-52365

Affected Products

Stabilizer

References · 8

• 🔥 https://github.com/h1dr1/CVE_Research/blob/main/CVE-2025-52365.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-52365 · Security Note
• https://osv.dev/vulnerability/CVE-2025-52365 · Vendor Advisory
• https://github.com/ccurtsinger/stabilizer/blob/master/szc · Note
• https://github.com/ccurtsinger/stabilizer · Note
• https://twitter.com/VulmonFeeds/status/2028883268225970220 · Twitter Post
• https://twitter.com/CVEnew/status/2028849471975727570 · Twitter Post
• https://t.me/CVEtracker/46203 · Telegram Post