CVE-2026-103056GHSA-7Q37-2WFW-XRX7
AiSOC 7.2.0 before 12.0.0 Command Injection via CrowdStrike RTR
- Published
- Last modified
- Status
- published
- Known exploitation
- Not listed in CISA KEV
- Fix
- Fixed in 12.0.0
- Public exploit
- None on Exploit-DB
CISA SSVC
- Exploitation: poc
- Automatable: no
- Technical impact: total
?
Decision points from CISA's Vulnrichment, assessed (SSVC 2.0.3).
SSVC documentationSummary
AiSOC versions 7.2.0 before 12.0.0 contain a command injection vulnerability in the actions service that builds CrowdStrike Real Time Response command strings by interpolating unescaped action parameters in crowdstrike_rtr.py and endpoint.py. Authenticated users can inject single quotes into file_path, path, script_name, or script_args parameters to break out of quoted arguments and execute arbitrary commands on managed endpoints with SYSTEM or root privileges.
Affected versions
- beenuar AiSOC
From 7.2.0 · fixed in 12.0.0