CVE-2026-129124 · Package
NO FIX YET · SEE WHAT TO DO
C-Kermit before 11.1.515 passes unquoted arguments from REMOTE WHO and REMOTE SPACE into a shell call. A remote client can append shell metacharacters and run commands on the server host, even when DISABLE HOST is set.
first public Oct 31, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Systems running C-Kermit before 11.1.515 that accept remote client connections and let clients issue REMOTE WHO or REMOTE SPACE. The sources say the flaw works even with DISABLE HOST set, so that setting is not a sufficient mitigation. Systems where C-Kermit is only used locally, with no remote clients, are less exposed.
Not affected if no-remote-clients, version-11.1.515-or-later
Who cares c-kermit, linux, self-hosted, unix
kermit and check the version banner against 11.1.515.WHOCMD or SPACM2 settings in your Kermit configuration.11.1.515 or later.C-Kermit before 11.1.515 contains an OS command injection vulnerability that allows remote clients to execute shell commands by supplying unquoted arguments to REMOTE WHO or REMOTE SPACE. Attackers can append shell metacharacters to arguments passed through WHOCMD or SPACM2 to syscmd(), executing commands on the server host even when DISABLE HOST is set.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.