PT-2026-27325 · Unknown · Perf-Ninja

Titan Team · Published 2026-03-24 · Updated 2026-03-24 · CVE-2026-4745

Positive Technologies (AI Summary)

CVSS v4.0

10

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/S:N/AU:Y/R:U/V:D/RE:L/U:Amber

Name of the Vulnerable Software and Affected Versions perf-ninja (affected versions not specified)

Description An improper control of code generation issue, specifically a code injection flaw, exists in the ldo.C module within perf-ninja’s labs/misc/pgo/lua components. This allows for the injection of Lua bytecode, potentially leading to remote code execution (RCE) accessible over a network.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2026-4745

Affected Products

Perf-Ninja

References · 4

• https://github.com/dendibakh/perf-ninja/pull/129 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-4745 · Security Note
• https://twitter.com/0dayPublishing/status/2036298020979945552 · Twitter Post
• https://twitter.com/ctiwatchcloud/status/2036412716450037971 · Twitter Post