CVE-2026-70377

7.5 HIGHpublic exploit available

Published 2026-08-05 · Updated 2026-08-10

AI risk analysis

Summary: The flaw allows remote code execution by manipulating the ratio parameter in imagecli's pipeline operation without proper validation, leading to potential crashes or arbitrary code execution.
Exploitability: Exploitation requires user-controlled input for the ratio parameter and embedding of imagecli as a library. The exploit is relatively easy given these preconditions.
Blast radius: If exploited, this could impact any application using imagecli that accepts user input, potentially leading to remote code execution or service disruption.
Prioritized remediation: Update to the latest version of imagecli that includes proper validation for the ratio parameter.

rceinput-validationlibrary-exploitremote-code-execution

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

imagecli's pipeline operation (Scale::apply in src/image_ops.rs) computes output width/height as (dimension as f32 * ratio) as u32 with no upper-bound validation on the CLI-supplied ratio, which is parsed via nom::number::complete::float with no range check. Any application embedding imagecli as a library and accepting user-controlled pipeline strings is remotely crashable with a single request.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weaknesses

CWE-789

Public exploit & PoC references

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.