---
id: "CVE-2026-65952"
page: "https://infrastack.ai/live/CVE-2026-65952"
kind: "vulnerability"
aliases: ["CVE-2026-65952"]
title: "Lenovo XClarity Essentials OneCLI: crafted remote path runs OS commands over SSH"
severity: "high"
cvss: 8.5
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "Lenovo XClarity Essentials OneCLI (Linux)", "fixed": [], "affected": "5.5.0", "ecosystem": "vendor"}]
ecosystems: []
tags: ["command-injection", "infrastructure", "lenovo", "linux", "self-hosted", "ssh", "xclarity-essentials-onecli"]
not_affected_if: ["not-linux", "not-onecli-5.5.0"]
published_at: "2026-11-11T22:17:27+00:00"
first_seen_at: "2026-11-11T22:29:34+00:00"
updated_at: "2026-11-11T22:34:35+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-65952", "first_seen_at": "2026-11-11T22:29:34+00:00"}, {"source": "analyst", "url": "https://support.lenovo.com/us/en/product_security/LEN-223503", "first_seen_at": "2026-11-11T22:34:35+00:00", "cites": ["https://support.lenovo.com/us/en/product_security/LEN-223503", "https://notcve.org/cve/CVE-2026-65952"]}]
exploit_sources: []
---

# Lenovo XClarity Essentials OneCLI: crafted remote path runs OS commands over SSH

Link for people: https://infrastack.ai/live/CVE-2026-65952 (this .md is for agents)

Lenovo XClarity Essentials OneCLI 5.5.0 for Linux fails to neutralize special characters in a remote path used by its SSH operations. An attacker who supplies a specially crafted path can run arbitrary OS commands with the privileges of the configured SSH account on a managed server.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Lenovo XClarity Essentials OneCLI (Linux) affected 5.5.0 fixed no fixed version listed

## How to check

Run OneCLI --version on Linux hosts; version 5.5.0 is named as affected (earlier versions not confirmed either way). Check scripts or jobs that pass a remote path from untrusted input to OneCLI SSH operations. Read LEN-223503 on support.lenovo.com for the fixed version.

## Fix

unknown: the fixed version is not confirmed. Read LEN-223503 and move to the version it names. The latest OneCLI release is 5.7.0.

## Timeline

- 2026-11-11T22:29:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-65952
- 2026-11-11T22:34:35+00:00 analyst https://support.lenovo.com/us/en/product_security/LEN-223503 — Lenovo PSIRT advisory is LEN-223503 (published 2026-09-08), but the page is JS-rendered and unreadable (web-cli returns only the title, browser quota exhausted). Fixed version NOT confirmed; nothing verified. Sibling LEN-216072 (CVE-2026-16791) was fixed in 5.6.0, which may not apply here. 5.7.0 is the latest release.

## Documents

- [advisory] Lenovo XClarity OneCLI Vulnerabilities (LEN-223503) https://support.lenovo.com/us/en/product_security/LEN-223503
- [mentions] notcve: CVE-2026-65952 https://notcve.org/cve/CVE-2026-65952

## From the sources

Improper neutralization of special elements used in an OS command in the remote SSH operation functionality of Lenovo XClarity Essentials OneCLI 5.5.0 for Linux could allow an attacker to execute arbitrary OS commands with the privileges of the configured SSH account on a managed server by supplying a specially crafted remote path.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_