{"id":"CVE-2026-104989","kind":"vulnerability","aliases":["CVE-2026-104989"],"related":[],"title":"Chaos V-Ray: unauthenticated package upload lets attackers run remote code","description":"Uncontrolled search path element in package upload feature in Chaos Software V-Ray versions through 2.0.19 allows remote unauthenticated attackers to execute arbitrary code via redirecting access to libraries","summary":"Chaos Software V-Ray versions through 2.0.19 have an uncontrolled search path in the package upload feature. A remote attacker without an account can redirect library loading and execute arbitrary code.","severity":"critical","cvss":9.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["chaos-software","other","v-ray","windows"],"not_affected_if":["unknown"],"how_to_check":"- Check the installed V-Ray version against the affected range (through `2.0.19`)\n- Look for the package upload feature being reachable from the network","fix":null,"status":"open","published_at":"2026-11-09T17:17:07+00:00","first_seen_at":"2026-11-09T17:27:37+00:00","triaged_at":"2026-11-09T17:28:44+00:00","updated_at":"2026-11-09T17:29:13+00:00","category":"other","confidence":0.3,"triage":{"at":"2026-11-09T17:28:44Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Chaos V-Ray: unauthenticated package upload lets attackers run remote code","impact":"high","summary":"Chaos Software V-Ray versions through 2.0.19 have an uncontrolled search path in the package upload feature. A remote attacker without an account can redirect library loading and execute arbitrary code.","audience":"businesses","category":"other","nicknames":[],"who_cares":["v-ray","chaos-software","windows"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker runs arbitrary code on the host via library redirection","analyst_note":"Confirm the affected product, the fixed version and whether the upload feature is on by default; the NVD entry alone gives no fix or exposure details.","how_to_check":"- Check the installed V-Ray version against the affected range (through `2.0.19`)\n- Look for the package upload feature being reachable from the network\n- unknown for anything beyond this","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Teams running Chaos Software V-Ray versions through 2.0.19 with the package upload feature reachable over the network. The sources do not say which deployments expose it by default.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000691,"input_tokens":4527,"output_tokens":476,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm the affected product, the fixed version and whether the upload feature is on by default; the NVD entry alone gives no fix or exposure details.","search":"'-104989':15A,18A '-2026':14A,17A '2.0.19':34B,75C 'access':86C 'account':50B 'allow':76C 'arbitrari':57B,82C 'attack':9A,47B,79C 'chao':1A,20B,27B,68C 'chaos-softwar':19B 'code':12A,58B,83C 'cve':13A,16A 'element':62C 'execut':56B,81C 'featur':44B,66C 'let':8A 'librari':53B,88C 'load':54B 'packag':6A,42B,64C 'path':39B,61C 'ray':4A,25B,31B,72C 'redirect':52B,85C 'remot':11A,46B,77C 'run':10A 'search':38B,60C 'softwar':21B,28B,69C 'unauthent':5A,78C 'uncontrol':37B,59C 'upload':7A,43B,65C 'v':3A,24B,30B,71C 'v-ray':2A,23B,29B,70C 'version':32B,73C 'via':84C 'window':26B 'without':48B","nicknames":[],"mitigations":[],"who_affected":"Teams running Chaos Software V-Ray versions through 2.0.19 with the package upload feature reachable over the network. The sources do not say which deployments expose it by default.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["chaossoftware","critical","other","vray","windows"],"campaign_type":null,"search_a":"'-104989':15A,18A '-2026':14A,17A 'attack':9A 'chao':1A 'code':12A 'cve':13A,16A 'let':8A 'packag':6A 'ray':4A 'remot':11A 'run':10A 'unauthent':5A 'upload':7A 'v':3A 'v-ray':2A","search_b":"'2.0.19':34B 'account':50B 'arbitrari':57B 'attack':47B 'chao':20B,27B 'chaos-softwar':19B 'code':58B 'execut':56B 'featur':44B 'librari':53B 'load':54B 'packag':42B 'path':39B 'ray':25B,31B 'redirect':52B 'remot':46B 'search':38B 'softwar':21B,28B 'uncontrol':37B 'upload':43B 'v':24B,30B 'v-ray':23B,29B 'version':32B 'window':26B 'without':48B","search_c":"'2.0.19':75C 'access':86C 'allow':76C 'arbitrari':82C 'attack':79C 'chao':68C 'code':83C 'element':62C 'execut':81C 'featur':66C 'librari':88C 'packag':64C 'path':61C 'ray':72C 'redirect':85C 'remot':77C 'search':60C 'softwar':69C 'unauthent':78C 'uncontrol':59C 'upload':65C 'v':71C 'v-ray':70C 'version':73C 'via':84C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T17:17:07+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"mandiant-cve@google.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-104989","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104989","severity":null,"published_at":"2026-11-09T17:17:07+00:00","modified_at":"2026-11-09T17:17:07+00:00","first_seen_at":"2026-11-09T17:27:37+00:00","fetched_at":"2026-11-09T17:27:37+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-104989:2303","url":null,"severity":null,"published_at":"2026-11-09T17:29:13+00:00","modified_at":"2026-11-09T17:29:13+00:00","first_seen_at":"2026-11-09T17:29:13+00:00","fetched_at":"2026-11-09T17:29:13+00:00","note":"Could not reach a primary source: web-cli search out of Exa credits, NVD page via WebFetch returned no content, chaos.com/security 404. No vendor advisory, fixed version or default-on status found. Nothing verified; fix stays unknown. Needs vendor advisory from Chaos to settle fix and whether package upload is on by default."}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}