PT-2026-31297 · Unknown · Coolercontrold

Published 2026-04-08 · Updated 2026-04-12 · CVE-2026-5208

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions CoolerControl/coolercontrold versions prior to 4.0.0

Description A command injection issue exists in alerts within CoolerControl/coolercontrold. Authenticated attackers can execute arbitrary code as root by injecting bash commands into alert names.

Recommendations Update CoolerControl/coolercontrold to version 4.0.0 or later.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-5208

Affected Products

Coolercontrold

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-5208 · Security Note
• https://gitlab.com/coolercontrol/coolercontrol/-/blob/3.1.0/coolercontrold/src/alerts.rs?ref_type=tags#L576 · Note
• https://twitter.com/cyberbivash/status/2041864654394167306 · Twitter Post
• https://gitlab.com/coolercontrol/coolercontrol/-/releases/4.0.0 · Note
• https://twitter.com/CVEnew/status/2043295667099979910 · Twitter Post
• https://t.me/CVEtracker/50053 · Telegram Post