CVE-2026-105487: yogeshojha reNgine listTargets Endpoint tasks.py subdomain_discovery os command injection
A vulnerability was found in yogeshojha reNgine up to 2.2.0. Affected by this vulnerability is the function subdomaindiscovery of the file web/reNgine/tasks.py of the component listTargets Endpoint. The manipulation of the argument Name results in os command injection. The attack can be launched remotely. The exploit has been made public and could be used. The pull request to fix this issue awaits acceptance.
Affected Software
Event History
Frequently Asked Questions
Does exploitation require authentication?
The CVSS vector indicates low privileges are required (PR:L). The issue is remotely reachable and does not require user interaction (UI:N).
How likely is active exploitation?
A public exploit is available, and the exploit maturity metric is rated P. This lowers the barrier for attackers with the required low-level access.
Is a vendor fix available?
The provided information states that a pull request to fix the issue is awaiting acceptance. It does not identify an accepted fix or a release containing the fix.