CVE-2026-76761
HighCVSS 7.3Exploitation Probability (EPSS)
Elevated risk74th percentile - higher than 74% of all known CVEs
Summary
A vulnerability in chenhg5 cc-connect up to 1.4.1 in the shellExecCommand function of core/engine.go in the Management API allows remote OS command injection via the exec argument. The exploit is publicly available.
Risk Assessment
An attacker can remotely execute arbitrary system commands, potentially leading to full system compromise or data breach.
Recommendation
Update cc-connect to the latest version or apply available security patches.
Other vulnerabilities in cc-connect
See all- CVE-2026-108549High
cc-connect through 1.5.0 contains a missing authentication vulnerability in the MAX platform adapter webhook mode. When no webhook_secret is configured, remote attackers can send unauthenticated updates to port 8080 and spoof an allowed or admin user_id to run privileged commands like /shell on the host.
- CVE-2026-92801High
cc-connect through 1.5.0 fails to enforce per-user allowlist filtering in the onCardAction handler for Feishu interactive card callbacks. Attackers can dispatch agent commands by triggering card actions in admitted chats, bypassing the per-user access controls that protect the text message handler.
- CVE-2026-76760High
A vulnerability in chenhg5 cc-connect up to 1.4.1 in the Authenticate function of core/webhook.go allows remote code injection via the exec argument. The exploit is publicly available.
Original NVD description (English source)
A vulnerability was identified in chenhg5 cc-connect up to 1.4.1. This affects the function shellExecCommand of the file core/engine.go of the component Management API. Such manipulation of the argument exec leads to os command injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The reported GitHub issue was closed automatically due to inactivity.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS