CVE-2026-107202: OS Command Injection
A command injection vulnerability exists in the h-ui (version v0.0.25 and below) administrative API due to improper validation of the listen configuration field. When an authenticated administrator submits a value containing shell metacharacters, the application constructs nftables/iptables rule strings using fmt.Sprintf and executes them via bash -c as root. Because the listen field lacks port or format validation, arbitrary OS commands can be injected and executed with root privileges.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An attacker must be able to authenticate to the h-ui administrative API as an administrator and submit a crafted listen configuration value. The issue affects h-ui v0.0.25 and earlier.
What level of access can successful exploitation provide?
Successful exploitation can execute arbitrary operating-system commands as root, because the application runs the constructed nftables or iptables command through bash -c with root privileges.
What input is involved in the attack?
The vulnerable input is the listen configuration field. Shell metacharacters in that field can be incorporated into command strings because the field is not validated as a port or otherwise constrained to an expected format.