CVE-2026-112077
Received Received - Intake

Remote Code Execution in radare2 via HTTP Sandbox Misconfiguration

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: VulDB

Description
A vulnerability was detected in radareorg radare2 6.2.0/6.2.2. This issue affects the function r_core_cmd_str_pipe in the library libr/core/rtr_http.inc.c of the component HTTP Sandbox Policy Handler. Performing a manipulation results in protection mechanism failure. Remote exploitation of the attack is possible. The attack is considered to have high complexity. The exploitability is assessed as difficult. Upgrading to version 6.2.4 is capable of addressing this issue. The patch is named 18fd12efa98a7d1977de7bdd379d8a848777b90f. Upgrading the affected component is recommended. The pre-requisite of the vulnerability is reflected by the CVSS vector. One of the project maintainers explains: "There is a real sandbox configuration issue here, but the report overstates it. The HTTP server defaults to http.sandbox=true, so commands received through /cmd temporarily enable cfg.sandbox. However, cfg.sandbox.grain defaults to all, which means all sandbox capabilities - including exec - remain allowed. Therefore enabling the HTTP sandbox alone does NOT prevent commands from spawning processes. This only matters when the HTTP command endpoint is reachable by someone you do not trust. It is not a remote vulnerability by default: the HTTP server must first be started and exposed to the attacker."

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-19
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2026-112077
EUVD
EUVD-2026-104060

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
radareorg radare2 6.2.0
radareorg radare2 6.2.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-693 The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-112077 is a sandbox configuration issue in radare2 version 6.2.0/6.2.2. The HTTP sandbox feature, enabled by default, claims to restrict commands but actually allows all capabilities including process execution due to the default cfg.sandbox.grain setting. This creates misleading security expectations. The vulnerability requires the HTTP server to be exposed to untrusted users to be exploitable.

Detection Guidance

To detect this vulnerability, check if radare2 version 6.2.0 or 6.2.2 is installed. Verify if the HTTP server is running and exposed to untrusted networks. Inspect sandbox configurations for default settings that allow process execution. Commands like 'r2 -v' can show the version. Check HTTP server logs for unusual command execution requests.

Impact Analysis

If the HTTP server is exposed to untrusted users, attackers could execute arbitrary commands on the system through the HTTP interface. This could lead to unauthorized access, data theft, or system compromise depending on the privileges of the radare2 process.

Compliance Impact

The vulnerability does not directly impact GDPR or HIPAA compliance as it requires specific deployment conditions to be exploitable. The issue involves misleading security expectations in HTTP sandbox enforcement, which could lead to improper access controls if the HTTP server is exposed to untrusted users. However, the default configuration does not pose a remote risk unless the HTTP interface is intentionally or accidentally exposed.

Mitigation Strategies

Upgrade radare2 to version 6.2.4 or later. Disable the HTTP server if not needed. If the HTTP server must run, set 'http.sandbox=true' and configure 'cfg.sandbox.grain' to exclude 'exec' and other unnecessary capabilities. Restrict network exposure of the HTTP interface.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-112077. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart