CVE-2026-19332
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk47th percentile - higher than 47% of all known CVEs
Summary
A security vulnerability has been detected in NellyW8 MCP4EDA 1.0.0, in the component run_openlane/view_waveform. Manipulation of the argument design_name/vcd_file leads to command injection. Local access is required. The project was informed but has not responded.
Risk Assessment
A local attacker can execute arbitrary commands, potentially leading to system integrity compromise or data theft.
Recommendation
Wait for patches from the vendor and restrict local access to the application.
Original NVD description (English source)
A security vulnerability has been detected in NellyW8 MCP4EDA 1.0.0. Affected by this vulnerability is an unknown functionality of the component run_openlane/view_waveform. The manipulation of the argument design_name/vcd_file leads to command injection. Local access is required to approach this attack. The project was informed of the problem early through an issue report but has not responded yet.