CVE-2026-41015 Details
Description
radare2 before 9236f44, when configured on UNIX without SSL, allows command injection via a PDB name to rabin2 -PP. NOTE: although users are supposed to use the latest version from git (not a release), the date range for the vulnerable code was less than a week, occurring after 6.1.2 but before 6.1.3.
A command injection vulnerability has been identified in radare2 versions prior to 9236f44, when built on UNIX without SSL support. The issue arises in the PDB download process, where user-controlled PDB filenames are passed to 'rabin2 -PP' and injected into a shell command. This command is then executed, leading to the execution of arbitrary commands. The vulnerability was introduced in a commit that added a curl-based fallback for PDB downloads without SSL, allowing for exploitation by crafting a PDB filename that breaks out of the expected format.
Users can update to radare2 version 6.1.4, which addresses this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 16, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | [email protected] |
Affected Products
No affected product data is available for this CVE.
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 16, 2026 | CVE Modified | CISA-ADP |
| Apr 16, 2026 | New CVE Received | [email protected] |