PT-2026-42693 · Knplabs · Snappy

Published 2026-05-21 · Updated 2026-05-21 · CVE-2026-46643

Positive Technologies (AI Summary)

CVSS v4.0

7.5

High

Base vector

AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions KnpLabs Snappy versions prior to 1.7.1

Description A shell injection issue exists on POSIX systems where the escapeshellarg() function returns a string containing single-quote characters. This causes the is executable() check to fail, as it searches for a file name that includes those quotes. Consequently, the execution flow bypasses the safe branch, allowing the $command variable to retain its raw, unescaped value. This allows for command execution as the PHP process whenever the binary path is influenced by user-controlled configuration, environment variables derived from request data, or concatenated user fragments.

Recommendations Update to version 1.7.1. As a temporary workaround, ensure that is executable($path) is truthy before calling the constructor.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-46643

GHSA-VPR4-P6FQ-85JC

Affected Products

Snappy

References · 4

• https://osv.dev/vulnerability/GHSA-vpr4-p6fq-85jc · Vendor Advisory
• https://github.com/KnpLabs/snappy · Note
• https://github.com/KnpLabs/snappy/security/advisories/GHSA-vpr4-p6fq-85jc · Note
• https://twitter.com/dailycve/status/2057611703940956262 · Twitter Post