CVE-2026-36365 Details
Description
An issue in Lymphatus caesium-image-compressor All versions up to and including commit 02da2c6 allows a local attacker to execute arbitrary code via the shutdownMachine and putMachineToSleep functions in PostCompressionActions.cpp
A vulnerability allowing local attackers to execute arbitrary code has been identified in Lymphatus Caesium-Image-Compressor, in all versions up to and including commit 02da2c6. The issue arises in the PostCompressionActions component, specifically within the shutdownMachine and putMachineToSleep functions. These functions use system calls to execute operating system commands, such as shutting down or putting the machine to sleep, which can be exploited to run arbitrary code.
A public pull request has been submitted to address this vulnerability by replacing the unsafe system calls with QProcess::startDetached() using explicit argument lists, which avoids shell interpretation. The pull request can be found in the Lymphatus Caesium-Image-Compressor repository.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-77 | Improper Neutralization of Special Elements used in a Command ('Command Injection') | CISA-ADP |
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | CISA-ADP |
Affected Products
No affected product data is available for this CVE.
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 5, 2026 | CVE Modified | CISA-ADP |
| May 4, 2026 | New CVE Received | [email protected] |