Live › vulnerability › CVE-2026-118477
Go to dashboardThe ei_git_repo_url parameter in KaliFast's Git remote configuration endpoint is passed to an OS shell without sanitising. An authenticated attacker with a free account can run arbitrary commands on the server as www-data.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 12:32 UTC. All times on this page are UTC.
Teams running KaliFast on their own servers where users can register accounts; the vulnerable path is the Git remote configuration endpoint reached by an authenticated user. Installations with registration closed and no untrusted users may face less exposure, but the sources do not say. Unknown whether managed hosting is affected.
No product ranges from the sources yet.
2026061802ei_git_repo_url reaches a shell call; source does not say more2026061802 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The ei_git_repo_url parameter in the Git remote configuration endpoint of KaliFast is vulnerable to OS Command Injection. This OS Command Injection vulnerability allows an authenticated attacker (free registration available) to execute arbitrary commands on the KaliFast server with www-data privileges. Fixed in version 2026061802.
This page as .md · .json · in your agent: get_signal("CVE-2026-118477")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.