← Back to search

CVE-2026-51861

9.8 CRITICALpublic exploit available

Published 2026-09-30 · Updated 2026-10-02

AI risk analysis

Summary
The flaw allows code injection, enabling an attacker to execute arbitrary code, leading to potential system compromise.
Exploitability
Exploitation is relatively straightforward given the code injection vulnerability, requiring an attacker to craft a specific input.
Blast radius
If exploited, the impact could be severe, potentially leading to full system compromise and data loss.
Detection
No reliable host or network indicator is derivable from the published description.
Prioritized remediation
Upgrade to bisheng 2.5.0 or later.
rcecode-injectionweb

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to Code Injection in src/backend/bisheng/api/v1/validate.py.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-94

Public exploit & PoC references

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

Related by shared AI tags and CWE weakness class. Browse the full archive.