Vulnerability · Published Sep 2, 2026 · Assigned by GitHub_M

CVE-2026-53611Looking Glass: Remote Code Execution via Unanchored Regular Expression in BGPASPath Input Validation

Critical 9.8

In plain English

A critical-severity OS command injection in looking-glass from AS203038. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.0% (higher than 81% of all known vulnerabilities).

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)2.0%top 19.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Looking Glass is a modern, stateless network-diagnostic platform — a single self-contained Go binary that fronts a fleet of routers over SSH and exposes ping / traceroute / BGP lookups through a gRPC (ConnectRPC) API, an embedded SvelteKit web UI, and a lg-cli client. Prior to version 1.3.5, there is an OS Command Injection vulnerability resulting from an unanchored regular expression in the input validation layer. This issue has been patched in version 1.3.5.

Affected products (as reported)

Vendor	Product	Versions
AS203038	looking-glass	< 1.3.5

Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://github.com/AS203038/looking-glass/security/advisories/GHSA-8hgf-p844-425m x_refsource_CONFIRM
https://github.com/AS203038/looking-glass/releases/tag/1.3.5 x_refsource_MISC