PT-2026-32122 · Lawnchair · Lawnchair

CVE-2026-39866 · Published 2026-04-11 · Updated 2026-04-21

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Lawnchair versions prior to commit fcba413f55dd47f8a3921445252849126c6266b2

Description Command injection in the 'release update.yml' workflow dispatch input allows for arbitrary code execution. This issue occurs within the workflow engine and can be triggered by an unauthenticated user.

Recommendations Update to the version containing commit fcba413f55dd47f8a3921445252849126c6266b2.

Exploit

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2026-39866

GHSA-9PRC-PP2C-3427

Affected Products

Lawnchair

References · 7

• 🔥 https://github.com/LawnchairLauncher/lawnchair/security/advisories/GHSA-9prc-pp2c-3427 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/39xxx/CVE-2026-39866.json · Exploit
• https://github.com/LawnchairLauncher/lawnchair/commit/fcba413f55dd47f8a3921445252849126c6266b2 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-39866 · Security Note
• https://osv.dev/vulnerability/CVE-2026-39866 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/2042991978241999096 · Twitter Post
• https://twitter.com/CVEnew/status/2046571862747144221 · Twitter Post