Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
2.1

reNgine listTargets endpoint allows remote command execution

CVE-2026-105487 · published 13 days ago
Summary

The reNgine tool (versions up to 2.2.0) has a flaw in its listTargets function that lets an attacker send specially crafted input to run operating system commands on the server. This can be triggered from anywhere on the network and could let an attacker take control of the system. Apply the pending update as soon as it is released or restrict access to the affected endpoint until the fix is applied.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
yogeshojha rengine 2.0
Original advisory text
yogeshojha reNgine listTargets Endpoint tasks.py subdomain_discovery os command injection
A vulnerability was found in yogeshojha reNgine up to 2.2.0. Affected by this vulnerability is the function subdomain_discovery of the file web/reNgine/tasks.py of the component listTargets Endpoint. The manipulation of the argument Name results in os command injection. The attack can be launched remotely. The exploit has been made public and could be used. The pull request to fix this issue awaits acceptance.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
2.1 Low
Exploitation
1% chance of attack within 30 days
Type
CWE-77Command Injection
CWE-78OS Command Injection
Timeline
Published6 Oct 2026
Updated15 Oct 2026
First seen6 Oct 2026
Sources
CVE-2026-105487 · NVD
CVE-2026-105487 · MITRE
CVE-2026-105487 · OSV
Track software like this
Free during beta