CVE-2026-48097: NexTOR_IP_CHANGER has PATH Injection Leading to Arbitrary Command Execution
NexTor IP Changer is a command-line tool that leverages the Tor network to periodically rotate a user's IP address. Versions prior to 2.0.0 have a command execution vulnerability due to unsafe use of shell=True with commands that rely on executable resolution through the PATH environment variable. An attacker controlling the execution environment can place malicious executables such as sudo earlier in the PATH, resulting in execution of attacker-controlled code. Version 2.0.0 fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
NexTOR_IP_CHANGERto a version that resolves this vulnerability.Fixed in 2.0.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-48097?
The severity of CVE-2026-48097 is high with a score of 7.8.
What is CVE-2026-48097?
CVE-2026-48097 is a vulnerability in NexTor IP Changer that allows for arbitrary command execution due to path injection.
How do I fix CVE-2026-48097?
To fix CVE-2026-48097, upgrade NexTor IP Changer to version 2.0.0 or later.
What causes CVE-2026-48097?
CVE-2026-48097 is caused by the unsafe use of 'shell=True' which allows for command injection through the PATH environment variable.
What impact does CVE-2026-48097 have?
CVE-2026-48097 can lead to arbitrary command execution, potentially compromising system security.