CVE-2026-94434

Summary

A OS command injection flaw exists in TÜBİTAK BİLGEM's Pardus Boot Repair tool due to insufficient sanitization of user-supplied input passed to system commands. This allows an authenticated low-privilege user to execute arbitrary OS commands on the host system.

Exploitability

Exploitation requires local access with low-privilege credentials and knowledge of vulnerable input points, but the vulnerability is straightforward to trigger once identified.

Blast radius

Successful exploitation grants full system compromise (confidentiality, integrity, availability) to the attacker, potentially enabling persistence, lateral movement, or data theft across the affected Pardus environment.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade Pardus Boot Repair to version 1.0.9 or later.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.