CVE-2026-120275

Received Received - Intake

Command Injection in Minimax Code 0.5.8

Publication date: 2026-11-01

Last updated on: 2026-11-01

Assigner: VulDB

Description

A security flaw has been discovered in Shanghai Xi Yu Ji Zhi Technology Minimax Code 0.5.8. This affects an unknown part of the component Find Command Handler. The manipulation of the argument -exec results in os command injection. The attack may be performed from remote. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-11-01

Last Modified

2026-11-01

Generated

2026-11-02

AI Q&A

2026-11-02

EPSS Evaluated

N/A

NVD

CVE-2026-120275

Affected Vendors & Products

Vendor	Product	Version / Range
Shanghai Xi Yu Ji Zhi Technology	Minimax Code	0.5.8

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CWE-77	The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

This vulnerability is an OS command injection flaw in Shanghai Xi Yu Ji Zhi Technology Minimax Code 0.5.8. It exists in the Find Command Handler component where the -exec argument can be manipulated to execute arbitrary commands remotely. The vendor did not respond to the disclosure attempt.

Impact Analysis

An attacker could exploit this to run unauthorized commands on your system, potentially stealing data, installing malware, or disrupting services. The attack requires some user interaction and low privileges, making it easier to exploit than some other flaws.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality requirements or HIPAA's safeguards for protected health information. Organizations may face compliance penalties if exploited.

Mitigation Strategies

Immediately update or patch Minimax Code to the latest version. If no patch is available, disable the affected component or restrict network access to it. Monitor for unusual command execution patterns or unauthorized system changes.

Hi! I’m here to help you understand CVE-2026-120275. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...