CVE-2026-104584 Details
Description
reNgine up to v2.2.0 and current master branch (commit de4199222cca5618f1255930ce78987e47d43a99) is vulnerable to OS Command Injection via the custom_headers scan engine configuration field in web/reNgine/tasks.py (fetch_url and dir_file_fuzz functions).
A command injection vulnerability has been identified in reNgine versions through 2.2.0 and the current master branch (commit de4199222cca5618f1255930ce78987e47d43a99). The issue arises in the custom_headers scan engine configuration field within the file web/reNgine/tasks.py, specifically in the fetch_url and dir_file_fuzz functions. The vulnerability allows attackers to inject OS commands that are executed with root privileges inside the celery worker container.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 13, 2026CISA-ADP
Assessed Oct 19, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/AmalJafarzade/CVE-2026-104584 | CISA-ADP | ExploitTechnical Description |
| https://github.com/AmalJafarzade/CVE-2026-104584 | [email protected] | ExploitTechnical Description |
| https://github.com/yogeshojha/rengine | [email protected] | ProductVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| reNgine | <= 2.2.0 (semver) de4199222cca5618f1255930ce78987e47d43a99 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 19, 2026 | CVE Modified | CISA-ADP |
| Oct 13, 2026 | New CVE Received | [email protected] |