{"id":"CVE-2026-118477","kind":"vulnerability","aliases":["CVE-2026-118477"],"related":[],"title":"KaliFast: Git remote endpoint lets a registered user run server commands","description":"The ei_git_repo_url parameter in the Git remote configuration endpoint of KaliFast is vulnerable to OS Command Injection. This OS Command Injection vulnerability allows an authenticated attacker (free registration available) to execute arbitrary commands on the KaliFast server with www-data privileges. Fixed in version 2026061802.","summary":"The ei_git_repo_url parameter in KaliFast's Git remote configuration endpoint is passed to an OS shell without sanitising. An authenticated attacker with a free account can run arbitrary commands on the server as www-data.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["kalifast","other","self-hosted","web-app"],"not_affected_if":["registration-closed","version-2026061802-or-later"],"how_to_check":"- Check the installed KaliFast version and compare it with `2026061802`\n- Review the Git remote configuration endpoint and whether `ei_git_repo_url` reaches a shell call; source does not say more","fix":"- Upgrade KaliFast to `2026061802` or later\n- Unknown whether a workaround exists before upgrading","status":"open","published_at":"2026-10-28T12:17:40+00:00","first_seen_at":"2026-10-28T12:32:51+00:00","triaged_at":"2026-10-28T12:33:45+00:00","updated_at":"2026-10-28T12:33:45+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-10-28T12:33:45Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade KaliFast to `2026061802` or later\n- Unknown whether a workaround exists before upgrading","reach":"internet","title":"KaliFast: Git remote endpoint lets a registered user run server commands","impact":"high","summary":"The ei_git_repo_url parameter in KaliFast's Git remote configuration endpoint is passed to an OS shell without sanitising. An authenticated attacker with a free account can run arbitrary commands on the server as www-data.","category":"other","nicknames":[],"who_cares":["kalifast","self-hosted","web-app"],"confidence":0.7,"needs_auth":"yes","worst_case":"Attacker runs arbitrary commands on the server as www-data.","analyst_note":"Confirm which KaliFast builds expose the Git remote endpoint by default and whether registration is open by default; check the NVD entry and the vendor advisory for a workaround.","how_to_check":"- Check the installed KaliFast version and compare it with `2026061802`\n- Review the Git remote configuration endpoint and whether `ei_git_repo_url` reaches a shell call; source does not say more","needs_analyst":true,"not_affected_if":["registration-closed","version-2026061802-or-later"],"who_is_affected":"Teams running KaliFast on their own servers where users can register accounts; the vulnerable path is the Git remote configuration endpoint reached by an authenticated user. Installations with registration closed and no untrusted users may face less exposure, but the sources do not say. Unknown whether managed hosting is affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000619,"input_tokens":3340,"output_tokens":570,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-118477':14A,17A '-2026':13A,16A '2026061802':113C 'account':53B 'allow':90C 'app':25B 'arbitrari':56B,99C 'attack':49B,93C 'authent':48B,92C 'avail':96C 'command':11A,57B,83C,87C,100C 'configur':37B,75C 'cve':12A,15A 'data':64B,108C 'ei':27B,66C 'endpoint':4A,38B,76C 'execut':98C 'fix':110C 'free':52B,94C 'git':2A,28B,35B,67C,73C 'host':22B 'inject':84C,88C 'kalifast':1A,18B,33B,78C,103C 'let':5A 'os':43B,82C,86C 'paramet':31B,70C 'pass':40B 'privileg':109C 'regist':7A 'registr':95C 'remot':3A,36B,74C 'repo':29B,68C 'run':9A,55B 'sanitis':46B 'self':21B 'self-host':20B 'server':10A,60B,104C 'shell':44B 'url':30B,69C 'user':8A 'version':112C 'vulner':80C,89C 'web':24B 'web-app':23B 'without':45B 'www':63B,107C 'www-data':62B,106C","nicknames":[],"mitigations":[],"who_affected":"Teams running KaliFast on their own servers where users can register accounts; the vulnerable path is the Git remote configuration endpoint reached by an authenticated user. Installations with registration closed and no untrusted users may face less exposure, but the sources do not say. Unknown whether managed hosting is affected.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T12:17:40+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"6064c9f1-42e5-4cc5-a67a-1636d7a9d3fd","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118477","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118477","severity":null,"published_at":"2026-10-28T12:17:40+00:00","modified_at":"2026-10-28T12:17:40+00:00","first_seen_at":"2026-10-28T12:32:51+00:00","fetched_at":"2026-10-28T12:32:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}