Vulnerability · Published Sep 13, 2026 · Assigned by VulnCheck
CVE-2026-90770Spug through 3.4.0 Remote Code Execution via ping_check
High 8.8
In plain English
A high-severity OS command injection in spug from openspug. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 71% of all known vulnerabilities).
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)1.3%top 29.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Spug through 3.4.0 contains a remote code execution vulnerability in the ping_check function that interpolates user-supplied monitor addresses directly into shell commands without validation. Authenticated users with monitor permissions can inject shell metacharacters via the /monitor/run_test/ endpoint to execute arbitrary commands as the Spug process user.
Affected products (as reported)
Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- GitHub Issue #741 issue-tracking
- https://github.com/openspug/spug product
- https://github.com/openspug/spug/blob/v3.4.0/spug_api/apps/monitor/executors.py technical-description
- https://github.com/openspug/spug/blob/v3.4.0/spug_api/apps/monitor/views.py technical-description
- https://github.com/openspug/spug/commit/97aebf133e1f9cbb35ccebadab1faedfdfe93f42 patch
- VulnCheck Advisory: Spug through 3.4.0 Remote Code Execution via ping_check third-party-advisory