---
id: "CVE-2026-94434"
page: "https://infrastack.ai/live/CVE-2026-94434"
kind: "vulnerability"
aliases: ["CVE-2026-94434"]
title: "Pardus Boot Repair: OS command injection lets attackers run system commands"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "Pardus Boot Repair", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["boot-repair", "linux", "other", "pardus"]
not_affected_if: ["version-1.0.9-or-later"]
published_at: "2026-11-09T13:17:09+00:00"
first_seen_at: "2026-11-09T13:26:51+00:00"
updated_at: "2026-11-09T13:27:25+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-94434", "first_seen_at": "2026-11-09T13:26:51+00:00"}]
exploit_sources: []
---

# Pardus Boot Repair: OS command injection lets attackers run system commands

Link for people: https://infrastack.ai/live/CVE-2026-94434 (this .md is for agents)

Pardus Boot Repair, a boot repair tool from TÜBİTAK BİLGEM for the Pardus Linux distribution, does not neutralize special characters in input before passing it to an OS command. An attacker who can supply that input can run commands on the system.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Pardus Boot Repair affected range not listed fixed no fixed version listed

## How to check

- Check the installed version of Pardus Boot Repair; versions `1.0.8` before `1.0.9` are affected.

## Fix

- Pardus Boot Repair: upgrade to `1.0.9`

## Timeline

- 2026-11-09T13:26:51+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-94434

## From the sources

Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute Pardus Boot Repair allows OS Command Injection.

This issue affects Pardus Boot Repair: from 1.0.8 before 1.0.9.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_