---
id: "CVE-2026-66088"
kind: "vulnerability"
aliases: ["CVE-2026-66088"]
title: "openEQUELLA: scripting engine runs arbitrary OS commands for script editors"
severity: "critical"
cvss: 9.4
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["java", "openequella", "package", "self-hosted"]
not_affected_if: ["auth-required", "managed-hosting"]
published_at: "2026-10-29T02:16:52+00:00"
first_seen_at: "2026-10-29T02:36:47+00:00"
updated_at: "2026-10-29T02:38:00+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-66088", "first_seen_at": "2026-10-29T02:36:47+00:00"}]
---

# openEQUELLA: scripting engine runs arbitrary OS commands for script editors

In openEQUELLA before 2026.1, the system.execute() function available to the scripting engine runs supplied operating system commands without validation or an allow-list. A user who can create or edit scripts can run arbitrary commands with the privileges of the openEQUELLA service account.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed openEQUELLA version against `2026.1`; anything older is in range.
- Review which accounts can create or edit scripts in the openEQUELLA admin and scripting settings.

## Fix

- Upgrade openEQUELLA to `2026.1` or later.
- Until upgraded, restrict script creation and editing to trusted administrators only.

## Timeline

- 2026-10-29T02:36:47+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-66088

## From the sources

In openEQUELLA before 2026.1, the system.execute() function available to the scripting engine runs supplied operating system commands without validation or an allow-list of permitted executables. A user able to create or edit scripts can use it to execute arbitrary commands with the privileges of the openEQUELLA service account.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_