{"id":"CVE-2026-66088","kind":"vulnerability","aliases":["CVE-2026-66088"],"related":[],"title":"openEQUELLA: scripting engine runs arbitrary OS commands for script editors","description":"In openEQUELLA before 2026.1, the system.execute() function available to the scripting engine runs supplied operating system commands without validation or an allow-list of permitted executables. A user able to create or edit scripts can use it to execute arbitrary commands with the privileges of the openEQUELLA service account.","summary":"In openEQUELLA before 2026.1, the system.execute() function available to the scripting engine runs supplied operating system commands without validation or an allow-list. A user who can create or edit scripts can run arbitrary commands with the privileges of the openEQUELLA service account.","severity":"critical","cvss":9.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["java","openequella","package","self-hosted"],"not_affected_if":["auth-required","managed-hosting"],"how_to_check":"- Check the installed openEQUELLA version against `2026.1`; anything older is in range.\n- Review which accounts can create or edit scripts in the openEQUELLA admin and scripting settings.","fix":"- Upgrade openEQUELLA to `2026.1` or later.\n- Until upgraded, restrict script creation and editing to trusted administrators only.","status":"open","published_at":"2026-10-29T02:16:52+00:00","first_seen_at":"2026-10-29T02:36:47+00:00","triaged_at":"2026-10-29T02:38:00+00:00","updated_at":"2026-10-29T02:38:00+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-29T02:38:00Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade openEQUELLA to `2026.1` or later.\n- Until upgraded, restrict script creation and editing to trusted administrators only.","reach":"network","title":"openEQUELLA: scripting engine runs arbitrary OS commands for script editors","impact":"high","summary":"In openEQUELLA before 2026.1, the system.execute() function available to the scripting engine runs supplied operating system commands without validation or an allow-list. A user who can create or edit scripts can run arbitrary commands with the privileges of the openEQUELLA service account.","category":"package","nicknames":[],"who_cares":["openequella","self-hosted","java"],"confidence":0.7,"needs_auth":"yes","worst_case":"Commands run as the openEQUELLA service account on the server.","analyst_note":"Confirm the affected version range and whether the fix in 2026.1 is the only remediation; the NVD entry is the only source.","how_to_check":"- Check the installed openEQUELLA version against `2026.1`; anything older is in range.\n- Review which accounts can create or edit scripts in the openEQUELLA admin and scripting settings.","needs_analyst":true,"not_affected_if":["managed-hosting","auth-required"],"who_is_affected":"Teams running openEQUELLA before 2026.1 where users other than trusted administrators can create or edit scripts. The exposure is the scripting engine's access to system.execute(), so instances where only trusted staff write scripts carry less immediate risk but should still be upgraded.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.00061,"input_tokens":3313,"output_tokens":558,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-66088':13A,16A '2026.1':26B,70C 'abl':96C 'account':66B,116C 'allow':45B,89C 'allow-list':44B,88C 'arbitrari':5A,57B,107C 'avail':30B,74C 'command':7A,39B,58B,83C,108C 'creat':51B,98C 'cve':11A,14A 'edit':53B,100C 'editor':10A 'engin':3A,34B,78C 'execut':93C,106C 'function':29B,73C 'host':22B 'java':17B 'list':46B,90C 'openequella':1A,18B,24B,64B,68C,114C 'oper':37B,81C 'os':6A 'packag':19B 'permit':92C 'privileg':61B,111C 'run':4A,35B,56B,79C 'script':2A,9A,33B,54B,77C,101C 'self':21B 'self-host':20B 'servic':65B,115C 'suppli':36B,80C 'system':38B,82C 'system.execute':28B,72C 'use':103C 'user':48B,95C 'valid':41B,85C 'without':40B,84C","nicknames":[],"mitigations":[],"who_affected":"Teams running openEQUELLA before 2026.1 where users other than trusted administrators can create or edit scripts. The exposure is the scripting engine's access to system.execute(), so instances where only trusted staff write scripts carry less immediate risk but should still be upgraded.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"first_public_at":"2026-10-29T02:16:52+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"9c1820ae-fb77-4810-a8aa-ca46e7474d2f","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-66088","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-66088","severity":null,"published_at":"2026-10-29T02:16:52+00:00","modified_at":"2026-10-29T02:16:52+00:00","first_seen_at":"2026-10-29T02:36:47+00:00","fetched_at":"2026-10-29T02:36:47+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}