CVE-2026-108941: Linketic CityGaussian Sidecar Parsing common.py parse_cfg_args code injection
A vulnerability was identified in Linketic CityGaussian up to 2.0. This affects the function parsecfgargs of the file internal/utils/common.py of the component Sidecar Parsing. The manipulation of the argument cfgargs leads to code injection. The attack can only be performed from a local environment. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
The attack can only be performed from a local environment. Exploitation also requires low privileges and user interaction, according to the supplied CVSS vector.
What input must an attacker control?
The attacker must be able to manipulate the cfg_args argument processed by parse_cfg_args in internal/utils/common.py during Sidecar Parsing.
Which versions are reported as affected?
Linketic CityGaussian versions up to 2.0 are reported as affected.
Is a vendor fix available?
The project was informed through an issue report but had not responded at the time of the report. No fix or workaround is identified in the provided information.