{"id":"CVE-2026-94434","published":"2026-11-09T13:17:09.273","lastModified":"2026-11-10T16:24:34.337","description":"Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute Pardus Boot Repair allows OS Command Injection.\n\nThis issue affects Pardus Boot Repair: from 1.0.8 before 1.0.9.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-78"],"vendors":[],"products":[],"references":[{"url":"https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1486","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A OS command injection flaw exists in TÜBİTAK BİLGEM's Pardus Boot Repair tool due to insufficient sanitization of user-supplied input passed to system commands. This allows an authenticated low-privilege user to execute arbitrary OS commands on the host system.","exploitability":"Exploitation requires local access with low-privilege credentials and knowledge of vulnerable input points, but the vulnerability is straightforward to trigger once identified.","blast_radius":"Successful exploitation grants full system compromise (confidentiality, integrity, availability) to the attacker, potentially enabling persistence, lateral movement, or data theft across the affected Pardus environment.","remediation":"Upgrade Pardus Boot Repair to version 1.0.9 or later.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["os-command-injection","rce","local","authentication-bypass"],"model":"garnet-coder","analyzedAt":"2026-11-10T09:47:04.794Z"}}