PT-2026-32122 · Lawnchairlauncher+1 · Lawnchair

Published 2026-04-11 · Updated 2026-04-21 · CVE-2026-39866

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Lawnchair versions prior to commit fcba413f55dd47f8a3921445252849126c6266b2

Description Command injection in the 'release update.yml' workflow dispatch input allows for arbitrary code execution. This issue occurs within the workflow engine and can be triggered by an unauthenticated user.

Recommendations Update to the version containing commit fcba413f55dd47f8a3921445252849126c6266b2.

Exploit

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2026-39866

Affected Products

Lawnchair

References · 5

• 🔥 https://github.com/LawnchairLauncher/lawnchair/security/advisories/GHSA-9prc-pp2c-3427 · Exploit
• https://github.com/LawnchairLauncher/lawnchair/commit/fcba413f55dd47f8a3921445252849126c6266b2 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-39866 · Security Note
• https://twitter.com/CVEnew/status/2046571862747144221 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2042991978241999096 · Twitter Post