CVE-2026-53611 Details
Description
Looking Glass is a modern, stateless network-diagnostic platform — a single self-contained Go binary that fronts a fleet of routers over SSH and exposes ping / traceroute / BGP lookups through a gRPC (ConnectRPC) API, an embedded SvelteKit web UI, and a lg-cli client. Prior to version 1.3.5, there is an OS Command Injection vulnerability resulting from an unanchored regular expression in the input validation layer. This issue has been patched in version 1.3.5.
A critical OS command injection vulnerability has been identified in Looking Glass versions prior to 1.3.5. This issue arises from an unanchored regular expression in the input validation layer, which allows remote attackers to bypass validation checks and execute arbitrary shell commands via an internal SSH execution template. The vulnerability is particularly concerning for operators with public or untrusted access to the gRPC/HTTP2 API endpoints, as it can lead to full container compromise and the exfiltration of sensitive environment variables and infrastructure management credentials, such as backend SSH private keys.
Users are advised to upgrade to Looking Glass version 1.3.5 or later, where this vulnerability has been patched by anchoring the regular expression pattern to enforce a strict, whole-string allow-list match.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 2, 2026CISA-ADP
Assessed Sep 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/AS203038/looking-glass/releases/tag/1.3.5 | [email protected] | Release NotesVendor |
| https://github.com/AS203038/looking-glass/security/advisories/GHSA-8hgf-p844-425m | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| AS203038 Looking Glass | < 1.3.5 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 2, 2026 | CVE Modified | CISA-ADP |
| Sep 2, 2026 | New CVE Received | [email protected] |