CVE-2026-108941

Deferred Deferred - Pending Action

Code Injection in Linketic CityGaussian via Sidecar Parsing

Publication date: 2026-10-13

Last updated on: 2026-10-15

Assigner: VulDB

Description

A vulnerability was identified in Linketic CityGaussian up to 2.0. This affects the function parse_cfg_args of the file internal/utils/common.py of the component Sidecar Parsing. The manipulation of the argument cfg_args leads to code injection. The attack can only be performed from a local environment. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-13

EPSS Evaluated

2026-10-18

NVD

CVE-2026-108941

EUVD

EUVD-2026-98170

Affected Vendors & Products

Vendor	Product	Version / Range
Linketic	CityGaussian	2.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-74	The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

Executive Summary

This vulnerability is a code injection flaw in Linketic CityGaussian up to version 2.0. It occurs in the parse_cfg_args function of internal/utils/common.py where the cfg_args argument is processed. The issue arises because the code uses an unrestricted eval() function to parse a plain-text Python expression stored in a sidecar file. This allows attackers with local access to execute arbitrary code with the permissions of the running process, such as during mesh extraction or model viewing.

Detection Guidance

Check for the presence of cfg_args files in shared model directories or project folders. Inspect Python files like internal/utils/common.py, gs2d_mesh_extraction.py, vanilla_deformable_renderer.py, and vanilla_gs4d_renderer.py for eval() usage. Look for suspicious model loading or mesh extraction processes.

Impact Analysis

If you use affected versions of CityGaussian, an attacker with local access to your system could execute malicious code when you load a model or perform mesh extraction. This could lead to unauthorized access to your system, data theft, or further compromise of your environment. The attack is possible even before standard model data is processed, making it a significant risk for shared model directories.

Compliance Impact

The vulnerability allows arbitrary code execution through malicious cfg_args files, which could lead to unauthorized data access or modification. This could violate GDPR's data protection requirements if personal data is exposed or HIPAA's integrity and confidentiality rules if protected health information is compromised.

Mitigation Strategies

Stop using cfg_args files from untrusted sources. Replace eval() with a literal-only parser like ast.parse or ast.literal_eval in the vulnerable files. Avoid opening models from shared directories until patched. Monitor for unauthorized code execution during mesh extraction or model loading.

Hi! I’m here to help you understand CVE-2026-108941. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70