LENOVO XCLARITY ESSENTIALS ONECLI (LINUX) · CVE-2026-65952 · Infrastructure
NO FIX YET · SEE WHAT TO DO
Lenovo XClarity Essentials OneCLI 5.5.0 for Linux fails to neutralize special characters in a remote path used by its SSH operations. An attacker who supplies a specially crafted path can run arbitrary OS commands with the privileges of the configured SSH account on a managed server.
first public Nov 11, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams that run Lenovo XClarity Essentials OneCLI 5.5.0 on Linux to manage servers over SSH are exposed, and the risk is greatest where the remote path can be influenced by outside input. The sources do not name a fixed version or a vendor patch. Teams not running this OneCLI version on Linux can skip it.
Not affected if not-linux, not-onecli-5.5.0
Who cares command-injection, lenovo, linux, self-hosted, ssh, xclarity-essentials-onecli
5.5.0 is named as affected (earlier versions not confirmed either way)5.7.0Improper neutralization of special elements used in an OS command in the remote SSH operation functionality of Lenovo XClarity Essentials OneCLI 5.5.0 for Linux could allow an attacker to execute arbitrary OS commands with the privileges of the configured SSH account on a managed server by supplying a specially crafted remote path.
This page as .md · .json · CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.