---
id: "CVE-2026-118869"
kind: "vulnerability"
aliases: ["CVE-2026-118869"]
title: "SHIRASAGI 1.19.0\u20131.21.0: OS command injection in Open Data dataset harvest import"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "shirasagi", "fixed": ["1.21.1"], "affected": ">= 1.19.0, <= 1.21.0", "ecosystem": "vendor"}]
ecosystems: []
tags: ["cms", "command-injection", "open-data", "other", "self-hosted", "shirasagi"]
not_affected_if: ["auth-required", "no-shirasagi-install", "open-data-not-configured", "version-1.18.2-or-earlier"]
published_at: "2026-11-05T09:17:05+00:00"
first_seen_at: "2026-11-05T09:38:09+00:00"
updated_at: "2026-11-05T09:39:41+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118869", "first_seen_at": "2026-11-05T09:38:09+00:00"}, {"source": "analyst", "url": "https://www.ss-proj.org/support/1743.html", "first_seen_at": "2026-11-05T09:39:41+00:00", "cites": ["https://www.ss-proj.org/support/1743.html", "https://jvn.jp/en/jp/JVN55454512/", "https://github.com/shirasagi/shirasagi/commit/98eca87586f4a6f74114fdfa7a6b88d3e49af029"]}]
exploit_sources: []
---

# SHIRASAGI 1.19.0–1.21.0: OS command injection in Open Data dataset harvest import

SHIRASAGI (Japanese open-source CMS) v1.19.0 to v1.21.0 passes the harvest import 'URL' field of an Open Data dataset to an OS command. A logged-in user with permission to manage Open Data datasets and harvest imports can run arbitrary commands on the server (vendor's example: URL set to '|touch /tmp/hacked', then click 'Import dataset'). Fixed in v1.21.1. No exploitation in the wild reported.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:shirasagi affected >= 1.19.0, <= 1.21.0 fixed 1.21.1

## How to check

Check your SHIRASAGI version. Affected: v1.19.0 through v1.21.0. Not affected: v1.18.2 and earlier (no harvest feature or a safe implementation) and v1.21.1 or later. Also check whether Open Data is set up and which accounts have permission to manage Open Data datasets and their harvest imports; review existing harvest import URL fields for shell characters such as '|'.

## Fix

Upgrade SHIRASAGI to v1.21.1, or apply upstream commit 98eca87586f4a6f74114fdfa7a6b88d3e49af029 (https://github.com/shirasagi/shirasagi/commit/98eca87586f4a6f74114fdfa7a6b88d3e49af029).

## Timeline

- 2026-11-05T09:38:09+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118869
- 2026-11-05T09:39:41+00:00 analyst https://www.ss-proj.org/support/1743.html — Vendor page ss-proj.org/support/1743.html and JVN#55454512 read: affected 1.19.0-1.21.0, fixed 1.21.1, commit 98eca87. Requires auth plus Open Data harvest permission. No exploit/PoC beyond vendor's repro steps; not exploited per sources. Sibling CVE-2026-117679 (XSS) is in the same advisory.

## Documents

- [advisory] JVN#55454512 SHIRASAGI XSS and OS command injection (vendor) https://www.ss-proj.org/support/1743.html
- [advisory] JVN#55454512: Multiple vulnerabilities in SHIRASAGI https://jvn.jp/en/jp/JVN55454512/
- [fix] Fix commit for CVE-2026-118869 https://github.com/shirasagi/shirasagi/commit/98eca87586f4a6f74114fdfa7a6b88d3e49af029

## From the sources

An OS command injection vulnerability exists in SHIRASAGI, which may allow an authenticated attacker to execute arbitrary OS commands on the system running the product.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_