CVE-2026-76761: chenhg5 cc-connect Management API engine.go shellExecCommand os command injection
A vulnerability was identified in chenhg5 cc-connect up to 1.4.1. This affects the function shellExecCommand of the file core/engine.go of the component Management API. Such manipulation of the argument exec leads to os command injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The reported GitHub issue was closed automatically due to inactivity.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments of chenhg5 cc-connect up to version 1.4.1 are affected where the Management API is reachable by an attacker. The vulnerable code is the shellExecCommand function in core/engine.go.
Does an attacker need credentials or user interaction?
The supplied vector indicates network exploitation with low complexity and no required privileges or user interaction. An attacker can remotely manipulate the exec argument to trigger operating-system command injection.
How urgent is remediation?
The issue is rated high severity with a 7.3 score, and a public exploit is available. Prioritize restricting access to the Management API and applying a vendor-provided fix when one is available.
What can be done if patching is not immediately possible?
Restrict network access to the Management API so untrusted remote users cannot reach it. Because exploitation occurs through the exec argument, avoid exposing API functionality that permits attacker-controlled values to reach that argument.