An OS command injection vulnerability exists in SHIRASAGI, which may allow an authenticated attacker to execute arbitrary OS commands on…
Affects SHIRASAGI v1.19.0 through v1.21.0 on sites with open data set up, via the dataset harvest import feature. Fixed in v1.21.1.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
- Exploited
- No known exploitation
- Fix
- Fixed in SHIRASAGI v1.21.1
- Who is exposed
- Specific setups only
Do first: Check whether your setup matches what the bug needs. Affects SHIRASAGI versions v1.19.0 through v1.21.0 Requires the open data dataset harvest import feature on a site where open data is set up
- Last modified
- FIRST's estimate of the chance attackers exploit it in the next 30 days, updated daily.What do these mean? →
- 1.06% · 64th percentile
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 18/100 · provisional
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: total
Summary
An OS command injection flaw in the SHIRASAGI software lets an attacker who has a low-privilege login run arbitrary operating system commands on the host running the product. The attacker can reach it remotely over the network, and no user interaction is needed.
Read the original description
An OS command injection vulnerability exists in SHIRASAGI, which may allow an authenticated attacker to execute arbitrary OS commands on the system running the product.
cve.now Index
- Exploitation0/40No signal
- Exposure8/25Specific setups only, reachable over the network
- Reach?/20Unknown. No tracked technology or package matched
- Severity9.8/10CVSS 8.8, total technical impact per CISA
- No patch0/5No signal
What would change the score
- Would score about 68 if added to CISA KEV
- Would score about 63 if CISA's SSVC rates exploitation active
- Would score about 25 if CISA's SSVC rates it automatable
What to do
Check whether your setup matches what the bug needs.
Affects SHIRASAGI versions v1.19.0 through v1.21.0 Requires the open data dataset harvest import feature on a site where open data is set upUpgrade to a fixed version: SHIRASAGI v1.21.1.
Timeline
- CVE published
- First seen by cve.now
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: total
- Record last updated
Affected versions
- SHIRASAGI Project SHIRASAGI
From v1.19.0 · through v1.21.0
Evidence 2
- Link
- Link
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-118869
Is CVE-2026-118869 being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data
What does this mean?
An authenticated user can inject operating system commands through the open data dataset harvest import feature, so the commands run on the server hosting SHIRASAGI. The advisory describes the impact as arbitrary OS command execution on the system running the product.Source: jvn.jp, ss-proj.org
Which versions are affected by CVE-2026-118869?
SHIRASAGI: from v1.19.0 through v1.21.0.Source: cve.now feed data
Am I affected, and how do I check?
SHIRASAGI versions v1.19.0 through v1.21.0 are listed as affected, and the bug requires a site where open data is set up and the dataset harvest import feature is used. To check, look at the SHIRASAGI version in use and whether open data is configured on the site.Source: jvn.jp, ss-proj.org
How do I fix CVE-2026-118869?
Upgrade to SHIRASAGI v1.21.1, which the advisory lists as the fixed version. No workaround is listed in the facts.Source: jvn.jp, ss-proj.org