CVE-2026-51861 Details
Description
bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to Code Injection in src/backend/bisheng/api/v1/validate.py.
A code injection vulnerability has been identified in Bisheng versions 2.3.0, 2.4.0, and 2.4.0-beta1. The issue resides in the 'validate_code' function of the 'src/backend/bisheng/api/v1/validate.py' file, where user-controlled Python code is executed without any restrictions, leading to arbitrary code execution.
Users are advised to update to Bisheng version 2.4.0, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://gist.github.com/Ro1ME/a03814bf661b36823c3ef5e32af93298 | [email protected] | ExploitTechnical Description |
| https://github.com/dataelement/bisheng/issues/1995 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
Weakness Enumeration
No weakness enumeration is available for this CVE.
Affected Products
| Product | Versions |
|---|---|
| bisheng | 2.3.0 (semver) 2.4.0 (semver) 2.4.0-beta1 (semver) |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 30, 2026 | New CVE Received | [email protected] |