PT-2026-7898 · Arduino · Arduino-App-Lab

Ottimo + 1 · Published 2026-02-12 · Updated 2026-02-19 · CVE-2026-25933

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:P/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Arduino App Lab versions prior to 0.4.0

Description Arduino App Lab, a cross-platform IDE for developing Arduino Apps, contains a flaw in its Terminal component. Insufficient input sanitization and validation of data received from connected hardware devices, specifically in the info.Serial and info.Address metadata fields, allows for potential code execution. An attacker requires physical access to a compromised board to supply crafted strings containing shell metacharacters. These crafted strings are then executed with the privileges of the user running the application when the host system processes the fields.

Recommendations Update to version 0.4.0 or later.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-25933

GHSA-3652-939F-F7G4

Affected Products

Arduino-App-Lab

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25933.json · Exploit
• https://github.com/arduino/arduino-app-lab/security/advisories/GHSA-3652-939f-f7g4 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25933 · Security Note
• https://osv.dev/vulnerability/CVE-2026-25933 · Vendor Advisory
• https://github.com/arduino/arduino-app-lab/releases/tag/al-0.4.0 · Note
• https://t.me/cveNotify/152527 · Telegram Post
• https://twitter.com/CVEnew/status/2022053681252749549 · Twitter Post