{"id":"CVE-2026-65952","kind":"vulnerability","aliases":["CVE-2026-65952"],"related":[],"title":"Lenovo XClarity Essentials OneCLI: crafted remote path runs OS commands over SSH","description":"Improper neutralization of special elements used in an OS command in the remote SSH operation functionality of Lenovo XClarity Essentials OneCLI 5.5.0 for Linux could allow an attacker to execute arbitrary OS commands with the privileges of the configured SSH account on a managed server by supplying a specially crafted remote path.","summary":"Lenovo XClarity Essentials OneCLI 5.5.0 for Linux fails to neutralize special characters in a remote path used by its SSH operations. An attacker who supplies a specially crafted path can run arbitrary OS commands with the privileges of the configured SSH account on a managed server.","severity":"high","cvss":8.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Lenovo XClarity Essentials OneCLI (Linux)","fixed":[],"affected":"5.5.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["command-injection","infrastructure","lenovo","linux","self-hosted","ssh","xclarity-essentials-onecli"],"not_affected_if":["not-linux","not-onecli-5.5.0"],"how_to_check":"Run OneCLI --version on Linux hosts; version 5.5.0 is named as affected (earlier versions not confirmed either way). Check scripts or jobs that pass a remote path from untrusted input to OneCLI SSH operations. Read LEN-223503 on support.lenovo.com for the fixed version.","fix":"unknown: the fixed version is not confirmed. Read LEN-223503 and move to the version it names. The latest OneCLI release is 5.7.0.","status":"open","published_at":"2026-11-11T22:17:27+00:00","first_seen_at":"2026-11-11T22:29:34+00:00","triaged_at":"2026-11-11T22:31:32+00:00","updated_at":"2026-11-11T22:34:35+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-11T22:31:32Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Lenovo XClarity Essentials OneCLI: crafted remote path runs OS commands over SSH","impact":"high","summary":"Lenovo XClarity Essentials OneCLI 5.5.0 for Linux fails to neutralize special characters in a remote path used by its SSH operations. An attacker who supplies a specially crafted path can run arbitrary OS commands with the privileges of the configured SSH account on a managed server.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["lenovo","xclarity-essentials-onecli","linux","ssh"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Arbitrary commands run as the configured SSH account on managed servers.","analyst_note":"Find the Lenovo PSIRT advisory for this CVE to confirm the fixed version, the attack prerequisites and the reach.","how_to_check":"- Check whether `OneCLI` version `5.5.0` is installed on Linux hosts used to manage servers over SSH.\n- Look for remote SSH operations in scripts or jobs that pass paths from untrusted input to OneCLI.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["not-onecli-5.5.0","not-linux"],"who_is_affected":"Teams that run Lenovo XClarity Essentials OneCLI 5.5.0 on Linux to manage servers over SSH are exposed, and the risk is greatest where the remote path can be influenced by outside input. The sources do not name a fixed version or a vendor patch. Teams not running this OneCLI version on Linux can skip it.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.00077,"input_tokens":4556,"output_tokens":628,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the Lenovo PSIRT advisory for this CVE to confirm the fixed version, the attack prerequisites and the reach.","search":"'-2026':14A,17A '-65952':15A,18A '5.5.0':42B,105C 'account':79B,124C 'allow':109C 'arbitrari':69B,114C 'attack':60B,111C 'charact':49B 'command':10A,25B,71B,93C,116C 'command-inject':24B 'configur':77B,122C 'could':108C 'craft':5A,65B,133C 'cve':13A,16A 'element':88C 'essenti':3A,36B,40B,103C 'essentials':21A 'execut':113C 'fail':45B 'function':99C 'host':32B 'improp':84C 'infrastructur':27B 'inject':26B 'lenovo':1A,19A,28B,38B,101C 'linux':23A,29B,44B,107C 'manag':82B,127C 'neutral':47B,85C 'onec':4A,37B,41B,104C 'onecli':22A 'oper':58B,98C 'os':9A,70B,92C,115C 'path':7A,53B,66B,135C 'privileg':74B,119C 'remot':6A,52B,96C,134C 'run':8A,68B 'self':31B 'self-host':30B 'server':83B,128C 'special':48B,64B,87C,132C 'ssh':12A,33B,57B,78B,97C,123C 'suppli':62B,130C 'use':54B,89C 'xclariti':2A,35B,39B,102C 'xclarity':20A 'xclarity-essentials-onec':34B","nicknames":[],"mitigations":[],"who_affected":"Teams that run Lenovo XClarity Essentials OneCLI 5.5.0 on Linux to manage servers over SSH are exposed, and the risk is greatest where the remote path can be influenced by outside input. The sources do not name a fixed version or a vendor patch. Teams not running this OneCLI version on Linux can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["lenovoxclarityessentialsoneclilinux","xclarityessentialsoneclilinux"],"ptokens":["essentials","lenovo","linux","onecli","xclarity"],"labels":["commandinjection","high","infrastructure","lenovo","linux","selfhosted","ssh","xclarityessentialsonecli"],"campaign_type":null,"search_a":"'-2026':14A,17A '-65952':15A,18A 'command':10A 'craft':5A 'cve':13A,16A 'essenti':3A 'essentials':21A 'lenovo':1A,19A 'linux':23A 'onec':4A 'onecli':22A 'os':9A 'path':7A 'remot':6A 'run':8A 'ssh':12A 'xclariti':2A 'xclarity':20A","search_b":"'5.5.0':42B 'account':79B 'arbitrari':69B 'attack':60B 'charact':49B 'command':25B,71B 'command-inject':24B 'configur':77B 'craft':65B 'essenti':36B,40B 'fail':45B 'host':32B 'infrastructur':27B 'inject':26B 'lenovo':28B,38B 'linux':29B,44B 'manag':82B 'neutral':47B 'onec':37B,41B 'oper':58B 'os':70B 'path':53B,66B 'privileg':74B 'remot':52B 'run':68B 'self':31B 'self-host':30B 'server':83B 'special':48B,64B 'ssh':33B,57B,78B 'suppli':62B 'use':54B 'xclariti':35B,39B 'xclarity-essentials-onec':34B","search_c":"'5.5.0':105C 'account':124C 'allow':109C 'arbitrari':114C 'attack':111C 'command':93C,116C 'configur':122C 'could':108C 'craft':133C 'element':88C 'essenti':103C 'execut':113C 'function':99C 'improp':84C 'lenovo':101C 'linux':107C 'manag':127C 'neutral':85C 'onec':104C 'oper':98C 'os':92C,115C 'path':135C 'privileg':119C 'remot':96C,134C 'server':128C 'special':87C,132C 'ssh':97C,123C 'suppli':130C 'use':89C 'xclariti':102C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T22:17:27+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"psirt@lenovo.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-65952","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65952","severity":null,"published_at":"2026-11-11T22:17:27+00:00","modified_at":"2026-11-11T22:17:27+00:00","first_seen_at":"2026-11-11T22:29:34+00:00","fetched_at":"2026-11-11T22:29:34+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-65952:3610","url":"https://support.lenovo.com/us/en/product_security/LEN-223503","severity":null,"published_at":"2026-11-11T22:34:35+00:00","modified_at":"2026-11-11T22:34:35+00:00","first_seen_at":"2026-11-11T22:34:35+00:00","fetched_at":"2026-11-11T22:34:35+00:00","note":"Lenovo PSIRT advisory is LEN-223503 (published 2026-09-08), but the page is JS-rendered and unreadable (web-cli returns only the title, browser quota exhausted). Fixed version NOT confirmed; nothing verified. Sibling LEN-216072 (CVE-2026-16791) was fixed in 5.6.0, which may not apply here. 5.7.0 is the latest release.","cites":["https://support.lenovo.com/us/en/product_security/LEN-223503","https://notcve.org/cve/CVE-2026-65952"]}],"documents":[{"id":129651,"url":"https://support.lenovo.com/us/en/product_security/LEN-223503","title":"Lenovo XClarity OneCLI Vulnerabilities (LEN-223503)","kind":"advisory","source":"analyst","publisher":null,"text":"Lenovo PSIRT advisory LEN-223503 listed for CVE-2026-65952 (published 2026-09-08 per notcve.org). Page content is JavaScript-rendered and could not be read by the analyst.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":129652,"url":"https://notcve.org/cve/CVE-2026-65952","title":"notcve: CVE-2026-65952","kind":"other","source":"analyst","publisher":null,"text":"Published 2026-09-08. Lists Lenovo PSIRT LEN-223503 'Lenovo XClarity OneCLI Vulnerabilities' as the advisory. Not in CISA KEV.","published_at":null,"relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}