CVE-2026-53611
Received Received - Intake

OS Command Injection in Looking Glass Prior to 1.3.5

Publication date: 2026-09-02

Last updated on: 2026-09-02

Assigner: GitHub, Inc.

Description
Looking Glass is a modern, stateless network-diagnostic platform — a single self-contained Go binary that fronts a fleet of routers over SSH and exposes ping / traceroute / BGP lookups through a gRPC (ConnectRPC) API, an embedded SvelteKit web UI, and a lg-cli client. Prior to version 1.3.5, there is an OS Command Injection vulnerability resulting from an unanchored regular expression in the input validation layer. This issue has been patched in version 1.3.5.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-02
Last Modified
2026-09-02
Generated
2026-09-02
AI Q&A
2026-09-02
EPSS Evaluated
N/A
NVD
CVE-2026-53611
EUVD
EUVD-2026-70199

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
as203038 looking_glass to 1.3.5 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-53611 is a critical OS Command Injection vulnerability in Looking Glass software versions prior to 1.3.5. It occurs due to an unanchored regular expression in input validation for BGP ASPath values. Attackers can bypass sanitization by appending malicious shell commands to valid input, exploiting a substring match instead of whole-string validation.

Detection Guidance

Check if your Looking Glass instance is running a version prior to 1.3.5 by running: looking-glass --version. Inspect network traffic for suspicious SSH commands or payloads containing shell tokens like ';id; or similar. Monitor container logs for unexpected command executions or errors related to ASPath validation.

Impact Analysis

This vulnerability allows unauthenticated remote attackers to execute arbitrary shell commands within the container. It can lead to full container compromise, exposure of sensitive environment variables, and theft of infrastructure management credentials like backend SSH private keys.

Mitigation Strategies

Upgrade Looking Glass to version 1.3.5 or later immediately. If upgrading is not possible, restrict network access to the service to trusted IPs only and disable BGP ASPath lookups if unused. Review container logs for signs of exploitation and rotate any exposed credentials.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-53611. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart