Vulnerability · Published Oct 13, 2026 · Assigned by GitHub_M
CVE-2026-55601MultiTail: Shell injection in execute-on-match command handling
High 7.3
In plain English
A high-severity OS command injection in multitail from folkertvanheusden. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities).
Official description
MultiTail is a utility for monitoring multiple log files in one terminal. In version 7.1.5 and earlier, the -ex and -eX execute-on-match feature appended attacker-controlled matched input to a configured command inside double quotes, then check_filter_exec() in mt.c passed the constructed command through execute_program() in exec.c to sh -c. Partial escaping left shell metacharacters such as command substitution active, allowing an attacker who could influence monitored input to execute commands as the user running MultiTail. No fixed release is available as of this review.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| folkertvanheusden | multitail | <= 7.1.5 |
Weakness: CWE-78 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H