CVE-2026-51861
UnknownSummary
bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to Code Injection in src/backend/bisheng/api/v1/validate.py. The vulnerability allows unauthorized code execution in the application context.
Risk Assessment
An attacker can inject and execute arbitrary code, potentially leading to full server takeover or data access. This is a high-impact risk to confidentiality, integrity, and availability.
Recommendation
Upgrade bisheng to a version containing the fix and verify that input in validate.py is properly validated. Restrict API access for untrusted users.
Other vulnerabilities in bisheng
See all- CVE-2026-51860Unknown
bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to Directory Traversal in src/backend/bisheng/linsight/domain/task_exec.py. The vulnerability allows access to files outside the intended directory.
- CVE-2026-51859Unknown
bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to directory traversal in save_download_file (src/backend/bisheng/core/cache/utils.py:290). The vulnerability allows access to files outside the intended area.
- CVE-2026-82285High
bisheng through 2.6.0-fix2 contains a server-side request forgery vulnerability in the POST /api/v1/workflow/report/callback endpoint that lacks authentication and applies no URL scheme restrictions or host filtering. Unauthenticated attackers can supply arbitrary URLs to enumerate internal network services and cloud metadata endpoints, then retrieve captured responses from object storage using caller-supplied object names.
- CVE-2026-82278High
BISHENG before 2.6.0 contains a remote code execution vulnerability in the workflow run_once endpoint that allows authenticated users to execute arbitrary Python code. Attackers can submit crafted Code node definitions to the POST /api/v1/workflow/run_once endpoint, which executes them with exec() without sandboxing, gaining access to filesystem, credentials, and internal network resources.
Original NVD description (English source)
bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to Code Injection in src/backend/bisheng/api/v1/validate.py.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS