CVE-2026-104989: Pre-authentication remote code execution in Chaos V-Ray Swarm

Q: Which deployments are exposed?

Chaos Software V-Ray Swarm versions through 2.0.19 are affected. The issue is in the package upload feature.

Q: Does exploitation require authentication or prior access?

No. The vulnerability can be exploited remotely by an unauthenticated attacker.

Q: What capability does an attacker gain?

An attacker can execute arbitrary code by redirecting access to libraries through an uncontrolled search path element during package upload.

Published Nov 9, 2026

Updated

Uncontrolled search path element in package upload feature in Chaos Software V-Ray versions through 2.0.19 allows remote unauthenticated attackers to execute arbitrary code via redirecting access to libraries

Affected Software

1 affected component

Chaos Software V-Ray Swarm<=2.0.19

Event History

Nov 9, 2026

CVE Published

via MITRE·05:01 PM

Data Sourced

via MITRE·05:01 PM

DescriptionWeakness

Frequently Asked Questions

Which deployments are exposed?

Chaos Software V-Ray Swarm versions through 2.0.19 are affected. The issue is in the package upload feature.

Does exploitation require authentication or prior access?

No. The vulnerability can be exploited remotely by an unauthenticated attacker.

What capability does an attacker gain?

An attacker can execute arbitrary code by redirecting access to libraries through an uncontrolled search path element during package upload.

CVE-2026-104989: Pre-authentication remote code execution in Chaos V-Ray Swarm

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed?

Does exploitation require authentication or prior access?

What capability does an attacker gain?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

Does exploitation require authentication or prior access?

What capability does an attacker gain?