Vulnerability · Published Jan 23, 2026 · Assigned by zdi

CVE-2026-0759Katana Network Development Starter Kit executeCommand Command Injection Remote Code Execution Vulnerability

Critical 9.8

In plain English

A critical-severity OS command injection in Development Starter Kit from Katana Network. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.8% (higher than 79% of all known vulnerabilities).

Severity (CVSS 3.0)9.8Critical

Exploit odds (30 days)1.8%top 21.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Katana Network Development Starter Kit executeCommand Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Katana Network Development Starter Kit. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of the executeCommand method. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-27786.

Affected products (as reported)

Vendor	Product	Versions
Katana Network	Development Starter Kit	7ecc3fa2a55404dc5eeb84ce2c673227015366e4

Weakness: CWE-78 · Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

ZDI-26-025 x_research-advisory