{"id":"CVE-2026-118692","aliases":[],"cve":{"records":[{"id":"CVE-2026-118692","source":"VulnCheck","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-10-28T17:31:29.498Z","published":"2026-10-28T21:11:19.351Z","modified":"2026-10-28T21:11:19.351Z"}],"publishers":[{"name":"VulnCheck","role":"CNA","organizationId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","modified":"2026-10-28T21:11:19.351Z"}],"references":[{"url":"https://github.com/giuspen/cherrytree/issues/2945","tags":["issue-tracking"],"source":"VulnCheck"},{"url":"https://github.com/giuspen/cherrytree","tags":["product"],"source":"VulnCheck"},{"url":"https://github.com/giuspen/cherrytree/blob/v1.7.2/src/ct/ct_actions_others.cc#L381-L388","tags":["technical-description"],"source":"VulnCheck"},{"url":"https://github.com/giuspen/cherrytree/blob/v1.7.2/src/ct/ct_misc_utils.cc#L227-L247","tags":["technical-description"],"source":"VulnCheck"},{"url":"https://www.vulncheck.com/advisories/cherrytree-through-1.7.2-os-command-injection-via-custom-web-link-action","tags":["third-party-advisory"],"source":"VulnCheck"}],"weaknesses":[{"id":"CWE-78","description":"Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","source":"VulnCheck"}],"applicability":[{"source":"VulnCheck","statements":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:cherrytree_project:cherrytree:*:*:*:*:*:*:*:*","versionEndIncluding":"1.7.2"}]}]}]}],"prioritization":[]},"title":"CherryTree through 1.7.2 OS Command Injection via Custom Web Link Action","titleSource":"VulnCheck","descriptionSource":"VulnCheck","description":"CherryTree through 1.7.2 contains an OS command injection vulnerability in CtActions::link_clicked that allows attackers to execute commands by embedding shell metacharacters in web link URLs. When the non-default Custom Web Link Clicked Action option is enabled, attackers can supply crafted documents whose links pass $(...), backticks, or semicolons unquoted to std::system, running commands as the victim on click.","score":7.1,"severity":"high","published":"2026-10-28T21:11:19.351Z","modified":"2026-10-28T21:11:19.351Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"giuspen","name":"cherrytree","platforms":[],"versions":[{"version":"0","status":"affected","lessThanOrEqual":"1.7.2","versionType":"custom"}],"defaultStatus":"unaffected","cpes":[],"source":"VulnCheck","url":"https://www.cve.org/CVERecord?id=CVE-2026-118692"}],"remediation":[],"references":["https://github.com/giuspen/cherrytree/issues/2945","https://github.com/giuspen/cherrytree","https://github.com/giuspen/cherrytree/blob/v1.7.2/src/ct/ct_actions_others.cc#L381-L388","https://github.com/giuspen/cherrytree/blob/v1.7.2/src/ct/ct_misc_utils.cc#L227-L247","https://www.vulncheck.com/advisories/cherrytree-through-1.7.2-os-command-injection-via-custom-web-link-action"],"sources":[{"name":"CVE","id":"CVE-2026-118692","modified":"2026-10-28T21:11:19.351Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-118692"}],"assessments":[{"source":"VulnCheck","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","score":7.1},{"source":"VulnCheck","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","score":7}],"sourceAffected":[],"observedAt":"2026-10-29T14:37:41.847Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T14:05:32.453Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-10-28T23:55:33.697Z","attemptedAt":"2026-10-28T23:55:33.697Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-10-28T23:55:34.166Z","attemptedAt":"2026-10-28T23:55:34.166Z"},{"source":"EUVD","status":"available","checkedAt":"2026-10-28T23:55:34.651Z","attemptedAt":"2026-10-28T23:55:34.651Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-10-28T23:55:34.170Z","attemptedAt":"2026-10-28T23:55:34.170Z"}],"evidence":[{"source":"NVD","id":"CVE-2026-118692","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118692","modified":"2026-10-28T22:17:13.387","score":7.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","checkedAt":"2026-10-28T23:55:33.697Z"},{"source":"NVD","id":"CVE-2026-118692","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118692","modified":"2026-10-28T22:17:13.387","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","checkedAt":"2026-10-28T23:55:33.697Z"},{"source":"ENISA EUVD","id":"EUVD-2026-112493","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-112493","modified":"Oct 28, 2026, 9:11:19 PM","score":7.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","checkedAt":"2026-10-28T23:55:34.651Z"}],"aiSummary":{"text":"CherryTree through 1.7.2 has an OS command injection vulnerability when the Custom Web Link Clicked Action option is enabled, allowing attackers to execute commands by embedding shell metacharacters in web link URLs. Attackers can supply crafted documents with unquoted links to run commands as the victim on click. The vulnerability requires the non-default option to be enabled.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-30T09:02:08.658Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-118692"}]}}