CVE-2026-5012

elecV2 elecV2P rpc pm2run os command injection

CVSS 6.9 MEDIUMEPSS 1.4%CWE-77 CWE-78

Vexday Risk Score

33Atención

Decisión SSVC (CISA)

Attend

PoC disponible → seguir de cerca

CVSS 6.9EPSS 1.4%KEV nãoPoC públicaNuclei —Metasploit —Patch —

Ciclo de vida

28 mar 2026Publicada en NVD

Recomendación: Planificar corrección próxima — ya existe PoC pública.

A flaw has been found in elecV2 elecV2P up to 3.8.3. This issue affects the function pm2run of the file /rpc. Executing a manipulation can lead to os command injection. The attack can be executed remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

Productos afectados

elecV2 · elecV2P

PoCs públicas encontradas — 1

cve_referencegithub.com/elecV2/elecV2P/issues/196no verificado

⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.

Referencias

https://github.com/elecV2/elecV2P/https://github.com/elecV2/elecV2P/issues/196 https://vuldb.com/submit/779174 https://vuldb.com/vuln/353897 https://vuldb.com/vuln/353897/cti