CVE-2026-105487
MediumCVSS 6.3Exploitation Probability (EPSS)
Elevated risk64th percentile - higher than 64% of all known CVEs
Summary
A vulnerability was found in yogeshojha reNgine up to 2.2.0 in the subdomain_discovery function of web/reNgine/tasks.py within the listTargets Endpoint component. Manipulation of the Name argument results in OS command injection. The attack can be launched remotely and the exploit has been made public.
Risk Assessment
OS command injection may allow an attacker to execute arbitrary commands on the server, leading to full system compromise. The public exploit increases the risk of exploitation.
Recommendation
Immediately improve validation of the Name argument in the subdomain_discovery function. Update the system or apply security patches.
Other vulnerabilities in reNgine
See all- CVE-2026-104584Unknown
reNgine up to v2.2.0 and the current master branch (commit de4199222cca5618f1255930ce78987e47d43a99) is vulnerable to OS Command Injection via the custom_headers scan engine configuration field in web/reNgine/tasks.py (fetch_url and dir_file_fuzz functions).
- CVE-2026-92570Medium
An authorization bypass vulnerability in reNgine through 2.2.0 in the GetFileContents API endpoint allows any authenticated user to read bundled recon tool configuration files. Low-privilege Auditor roles can access files containing third-party API keys for services like SecurityTrails, Shodan, Censys, VirusTotal, BinaryEdge and Hunter.
Original NVD description (English source)
A vulnerability was found in yogeshojha reNgine up to 2.2.0. Affected by this vulnerability is the function subdomain_discovery of the file web/reNgine/tasks.py of the component listTargets Endpoint. The manipulation of the argument Name results in os command injection. The attack can be launched remotely. The exploit has been made public and could be used. The pull request to fix this issue awaits acceptance.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS