CVE-2026-90843
Received Received - Intake

Command Injection in WebMap via Nmap Scan Handler

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: VulDB

Description
A security vulnerability has been detected in SabyasachiRana WebMap up to 8b95fe4dc301a3c09ddf145b895de0bf9f8d2a25. This affects the function nmap_newscan of the file functions_nmap.py of the component New Nmap Scan Handler. Such manipulation of the argument target/params leads to os command injection. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The name of the patch is 3d52f65803a2716bff14d938352c6fef45b0cfb6. A patch should be applied to remediate this issue. This issue got fixed with a silent patch.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-90843
EUVD
EUVD-2026-78229

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
sabyasachirana webmap to 8b95fe4dc301a3c09ddf145b895de0bf9f8d2a25 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-77 The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-90843 is an OS command injection vulnerability in SabyasachiRana WebMap up to version 8b95fe4dc301a3c09ddf145b895de0bf9f8d2a25. It affects the function nmap_newscan in functions_nmap.py, specifically in the New Nmap Scan Handler component. The flaw allows attackers to inject arbitrary shell commands via the target or params parameters due to insufficient input validation. The vulnerability can be exploited remotely without authentication.

Detection Guidance

Check if WebMap is running on your system by inspecting Docker containers with 'docker ps'. Look for exposed ports, especially 8000, and verify if it is bound to 0.0.0.0. Test input fields in the WebMap interface by attempting to inject commands like '; id' or '&& whoami' in the target or params fields to see if they execute.

Impact Analysis

This vulnerability allows attackers to execute arbitrary commands on the affected system with root privileges within the container. Since WebMap is typically deployed as a Docker container binding to all network interfaces by default, the service is exposed to the internet unless manually configured otherwise. Attackers could take full control of the container, steal data, or use it as a pivot point to attack other systems.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating GDPR's integrity and confidentiality principles or HIPAA's security requirements. Organizations may face fines, legal liabilities, and reputational damage due to non-compliance with data protection regulations if this flaw is exploited.

Mitigation Strategies

Update WebMap to the patched version or apply the silent patch commit 3d52f65803a2716bff14d938352c6fef45b0cfb6. If using Docker, restart the container with the service bound only to localhost (127.0.0.1:8000:8000). Disable or firewall the service if not needed. Monitor for suspicious activity or unauthorized access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-90843. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart