Vulnerability · Published Aug 19, 2026 · Assigned by VulDB

CVE-2026-76761chenhg5 cc-connect Management API engine.go shellExecCommand os command injection

High 7.3

In plain English

A high-severity OS command injection in cc-connect from chenhg5. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 2.1% (higher than 82% of all known vulnerabilities).

Severity (CVSS 3.1)7.3High

Exploit odds (30 days)2.1%top 18.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability was identified in chenhg5 cc-connect up to 1.4.1. This affects the function shellExecCommand of the file core/engine.go of the component Management API. Such manipulation of the argument exec leads to os command injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The reported GitHub issue was closed automatically due to inactivity.

Affected products (as reported)

Vendor	Product	Versions
chenhg5	cc-connect	1.4.01.4.1

Weakness: CWE-78, CWE-77 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

References

VDB-393231 | chenhg5 cc-connect Management API engine.go shellExecCommand os command injection vdb-entry, technical-description
VDB-393231 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
CVE-2026-76761 | CVE Analysis and Report third-party-advisory
Submit #878948 | chenhg5 cc-connect 1.4.1 Command Injection third-party-advisory
https://github.com/chenhg5/cc-connect/issues/1489 exploit, issue-tracking
https://github.com/chenhg5/cc-connect/ product