CVE-2026-104584
UnknownSummary
reNgine up to v2.2.0 and the current master branch (commit de4199222cca5618f1255930ce78987e47d43a99) is vulnerable to OS Command Injection via the custom_headers scan engine configuration field in web/reNgine/tasks.py (fetch_url and dir_file_fuzz functions).
Risk Assessment
An attacker can execute arbitrary OS commands on the server with the privileges of the reNgine process, potentially leading to full host compromise and data access. This is especially dangerous as reNgine is a security testing tool often run with elevated privileges.
Recommendation
Update reNgine to a patched version or apply a workaround by validating and sanitizing the custom_headers field. Restrict access to the reNgine interface and run it with minimal privileges.
Other vulnerabilities in reNgine
See all- CVE-2026-105487Medium
A vulnerability was found in yogeshojha reNgine up to 2.2.0 in the subdomain_discovery function of web/reNgine/tasks.py within the listTargets Endpoint component. Manipulation of the Name argument results in OS command injection. The attack can be launched remotely and the exploit has been made public.
- CVE-2026-92570Medium
An authorization bypass vulnerability in reNgine through 2.2.0 in the GetFileContents API endpoint allows any authenticated user to read bundled recon tool configuration files. Low-privilege Auditor roles can access files containing third-party API keys for services like SecurityTrails, Shodan, Censys, VirusTotal, BinaryEdge and Hunter.
Original NVD description (English source)
reNgine up to v2.2.0 and current master branch (commit de4199222cca5618f1255930ce78987e47d43a99) is vulnerable to OS Command Injection via the custom_headers scan engine configuration field in web/reNgine/tasks.py (fetch_url and dir_file_fuzz functions).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS