CVE-2026-76761

HighCVSS 7.3

Published: 19/08/2026(UTC)Updated: 20/08/2026(UTC)Translated: 20/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.58%

74th percentile - higher than 74% of all known CVEs

Summary

A vulnerability in chenhg5 cc-connect up to 1.4.1 in the shellExecCommand function of core/engine.go in the Management API allows remote OS command injection via the exec argument. The exploit is publicly available.

Risk Assessment

An attacker can remotely execute arbitrary system commands, potentially leading to full system compromise or data breach.

Recommendation

Update cc-connect to the latest version or apply available security patches.

Other vulnerabilities in cc-connect

CVE-2026-76760High
A vulnerability in chenhg5 cc-connect up to 1.4.1 in the Authenticate function of core/webhook.go allows remote code injection via the exec argument. The exploit is publicly available.

Original NVD description (English source)

A vulnerability was identified in chenhg5 cc-connect up to 1.4.1. This affects the function shellExecCommand of the file core/engine.go of the component Management API. Such manipulation of the argument exec leads to os command injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The reported GitHub issue was closed automatically due to inactivity.