{"id":"CVE-2026-110392","published":"2026-10-14T02:16:59.653","lastModified":"2026-10-16T19:56:15.773","description":"Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Samsung Open Source QA-Board allows : OS Command Injection.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-78"],"vendors":[],"products":[],"references":[{"url":"https://github.com/Samsung/qaboard/commit/05789e67c5d022f2403b9340fc8d82dc99dc3707","tags":[]}],"exploitRefs":[{"url":"https://github.com/Samsung/qaboard/commit/05789e67c5d022f2403b9340fc8d82dc99dc3707","tags":[]}],"hasPoc":true,"ai":{"summary":"This vulnerability allows attackers to inject arbitrary OS commands through the Samsung Open Source QA-Board application, potentially leading to complete system compromise with high impact on confidentiality, integrity, and availability.","exploitability":"Exploitation is relatively straightforward as it requires no authentication and can be achieved through a single malicious input that gets executed as an OS command, making it highly suitable for automated exploitation.","blast_radius":"If exploited, this vulnerability could allow attackers to execute arbitrary commands on the underlying server, potentially leading to full system compromise, data exfiltration, and service disruption across all systems relying on the QA-Board platform.","remediation":"Apply the vendor patch or upgrade to version 2.590 or later as specified in the Samsung Open Source QA-Board release notes.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["os-command-injection","web","rce"],"model":"garnet-coder","analyzedAt":"2026-10-14T08:52:53.260Z"}}