---
id: "CVE-2026-107240"
page: "https://infrastack.ai/live/CVE-2026-107240"
kind: "vulnerability"
aliases: ["CVE-2026-107240"]
title: "Versa VOS: unauthenticated newline injection runs shell commands on appliances"
severity: "high"
cvss: 7.6
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["infrastructure", "network-appliance", "sd-wan", "versa-flexvnf", "versa-vos"]
not_affected_if: ["provisioning-complete", "service-disabled"]
published_at: "2026-11-10T01:17:10+00:00"
first_seen_at: "2026-11-10T01:26:35+00:00"
updated_at: "2026-11-10T01:39:27+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107240", "first_seen_at": "2026-11-10T01:26:35+00:00"}, {"source": "analyst", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107240", "first_seen_at": "2026-11-10T01:39:27+00:00", "cites": ["https://nvd.nist.gov/vuln/detail/CVE-2026-107240", "https://docs.versa-networks.com/Management_and_Orchestration/Versa_Director/Configuration/Enable_Secure_Mode"]}]
exploit_sources: []
---

# Versa VOS: unauthenticated newline injection runs shell commands on appliances

Link for people: https://infrastack.ai/live/CVE-2026-107240 (this .md is for agents)

The Node.js provisioning service on Versa VOS (formerly FlexVNF) passes login fields to a shell without stripping newlines, so a newline in the username runs extra commands. An unauthenticated attacker who fetches a CSRF token from a page load can execute arbitrary commands as the versa OS service user.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- On each VOS device (branch, hub, controller), check whether the Node.js ZTP web service is still running; Versa says it is not needed after provisioning.
- Check whether the management/provisioning web interface (the /authenticate endpoint) is reachable from networks an attacker can reach.
- Per Versa, devices where the Node.js web service is disabled are not exploitable.
- Affected VOS versions are not published in the sources I could read; ask Versa support/PSIRT for the advisory.

## Timeline

- 2026-11-10T01:26:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-107240
- 2026-11-10T01:39:27+00:00 analyst https://nvd.nist.gov/vuln/detail/CVE-2026-107240 — Versa's own PSIRT advisory not found/readable; only NVD (HackerOne CNA text) and Versa docs. No affected ranges or fixed versions published in anything I could read; OffSeq's AI-suggested range not used. Fix left unknown. Mitigation from Versa docs: 'request system secure-mode enable disable-nodejs' then vsh restart. Note CVSS vector says PR:H/UI:R while text says unauthenticated; flagged. Siblings CVE-2026-107242/-107243/-107244 are the same ZTP Node.js service.

## Documents

- [describes] NVD: CVE-2026-107240 https://nvd.nist.gov/vuln/detail/CVE-2026-107240
- [mitigation] Versa docs: Enable Secure Mode (disable-nodejs option) https://docs.versa-networks.com/Management_and_Orchestration/Versa_Director/Configuration/Enable_Secure_Mode

## From the sources

The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete. The /authenticate endpoint of this service passes user-supplied username and password values to child_process.exec() through a sanitizer (escapeRegExp) that removes regular expression metacharacters but not newline characters. An unauthenticated attacker can inject a newline character into the username field to execute arbitrary shell commands as the versa OS service user. No credentials are required; the attacker needs only a CSRF token, which can be obtained from an unauthenticated page load. 

Versa’s security hardening guide for Hubs, Branches, and Controllers recommends disabling the Node.js web service after the initial provisioning of the VOS device. This vulnerability is not exploitable on VOS devices where the Node.js web service has been disabled.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_