CVE-2026-37281
OS Command Injection in Zenshin Before 2.7.0
Publication date: 2026-05-19
Last updated on: 2026-05-20
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| hitarth-gg | zenshin | to 2.7.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-78 | The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an OS command injection issue found in the /stream-to-vlc Express route of the hitarth-gg Zenshin application before version 2.7.0.
It allows remote attackers to execute arbitrary operating system commands by manipulating the url parameter in the affected route.
How can this vulnerability impact me? :
An attacker exploiting this vulnerability can run arbitrary commands on the server hosting the Zenshin application.
This can lead to unauthorized access, data theft, data manipulation, service disruption, or complete system compromise depending on the commands executed.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves OS command injection via the /stream-to-vlc Express route using the url parameter in hitarth-gg Zenshin before version 2.7.0.
To detect this vulnerability on your system or network, you can monitor HTTP requests targeting the /stream-to-vlc route and inspect the url parameter for suspicious or unexpected command injection patterns.
A practical approach is to use network traffic analysis tools or command line utilities such as curl or wget to test the endpoint with crafted payloads that attempt command injection.
- Use curl to send a test request to the vulnerable endpoint: curl -v 'http://<target-ip>:<port>/stream-to-vlc?url=;id'
- Check server logs for unusual command execution or errors related to the url parameter.
- Use network monitoring tools like tcpdump or Wireshark to capture and analyze traffic to the /stream-to-vlc route.
What immediate steps should I take to mitigate this vulnerability?
The primary mitigation is to upgrade hitarth-gg Zenshin to version 2.7.0 or later, where the vulnerability has been fixed by replacing the use of exec with spawn and binding the Express server to 127.0.0.1.
If immediate upgrade is not possible, restrict access to the vulnerable /stream-to-vlc route by firewall rules or network segmentation to prevent remote exploitation.
Avoid exposing the Express server to untrusted networks by binding it to localhost (127.0.0.1) as a temporary mitigation.
Review and sanitize all inputs to the url parameter to prevent command injection.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not specify how this OS command injection vulnerability in hitarth-gg Zenshin affects compliance with common standards and regulations such as GDPR or HIPAA.