---
id: "CVE-2026-118477"
kind: "vulnerability"
aliases: ["CVE-2026-118477"]
title: "KaliFast: Git remote endpoint lets a registered user run server commands"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["kalifast", "other", "self-hosted", "web-app"]
not_affected_if: ["registration-closed", "version-2026061802-or-later"]
published_at: "2026-10-28T12:17:40+00:00"
first_seen_at: "2026-10-28T12:32:51+00:00"
updated_at: "2026-10-28T12:33:45+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118477", "first_seen_at": "2026-10-28T12:32:51+00:00"}]
---

# KaliFast: Git remote endpoint lets a registered user run server commands

The ei_git_repo_url parameter in KaliFast's Git remote configuration endpoint is passed to an OS shell without sanitising. An authenticated attacker with a free account can run arbitrary commands on the server as www-data.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed KaliFast version and compare it with `2026061802`
- Review the Git remote configuration endpoint and whether `ei_git_repo_url` reaches a shell call; source does not say more

## Fix

- Upgrade KaliFast to `2026061802` or later
- Unknown whether a workaround exists before upgrading

## Timeline

- 2026-10-28T12:32:51+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118477

## From the sources

The ei_git_repo_url parameter in the Git remote configuration endpoint of KaliFast is vulnerable to OS Command Injection. This OS Command Injection vulnerability allows an authenticated attacker (free registration available) to execute arbitrary commands on the KaliFast server with www-data privileges. Fixed in version 2026061802.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_