PT-2026-41304 · Unknown · Oinone Pamirs

Published 2026-05-15 · Updated 2026-05-15 · CVE-2026-39052

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Oinone Pamirs version 7.0.0

Description An issue exists via ScriptRunner where the run(String expression, String type, Map<String, Object> context) function evaluates attacker-controlled script expressions through the underlying script engine. This occurs because the process lacks sandboxing (a security mechanism for separating running programs) or allowlist restrictions.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2026-39052

Affected Products

Oinone Pamirs

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-39052 · Security Note
• https://github.com/oinone/oinone-pamirs · Note
• https://gist.github.com/Misakim1/859c3eb9ced699089ee0747dae9bedc1 · Note
• https://oinone.top/changelog · Note
• https://t.me/CVEtracker/53922 · Telegram Post