CVE-2026-76148

Deferred Deferred - Pending Action

Code Injection Vulnerability in CorvusSKK Leading to Arbitrary Code Execution

Publication date: 2026-08-26

Last updated on: 2026-08-28

Assigner: JPCERT/CC

Description

CorvusSKK contains a code injection vulnerability, which may lead to arbitrary code execution on the affected product.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-26

Last Modified

2026-08-28

Generated

2026-09-15

AI Q&A

2026-08-26

EPSS Evaluated

2026-09-14

NVD

CVE-2026-76148

EUVD

EUVD-2026-66244

Affected Vendors & Products

Vendor	Product	Version / Range
corvusskk	corvusskk	3.3.4
corvusskk	corvusskk	to 3.3.4 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

Executive Summary

CorvusSKK has a code injection vulnerability that allows attackers to inject malicious code into the system. This could lead to arbitrary code execution, meaning an attacker could run unauthorized commands on the affected product.

Detection Guidance

This vulnerability is specific to CorvusSKK versions prior to 3.3.4 and involves code injection via Lua features. Detection should focus on identifying outdated versions of CorvusSKK. Check installed versions with commands like 'corvusskk --version' or inspect package managers for CorvusSKK entries. Compare versions against 3.3.4.

Impact Analysis

If exploited, this vulnerability could allow attackers to take control of your system, steal data, install malware, or perform other malicious actions. It poses a high risk to confidentiality, integrity, and availability of the affected system.

Compliance Impact

This vulnerability could lead to data breaches, which may violate GDPR and HIPAA requirements for data protection and security. Non-compliance may result in legal penalties, fines, or reputational damage.

Mitigation Strategies

Update CorvusSKK to the latest version to patch the code injection vulnerability. Disable unnecessary services or features that may be exposed to this issue. Monitor system logs for unusual activity or unauthorized code execution attempts.

Hi! I’m here to help you understand CVE-2026-76148. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70