Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-25933: Arduino App Lab can run code from a tampered board

CVE-2026-25933 · published 8 months ago

Summary

Versions of Arduino App Lab before 0.4.0 accept information from connected devices without checking it carefully. A specially altered board can send strings that cause the program to run unwanted commands on the user's computer. Updating to version 0.4.0 or later stops this behavior.

What to do

Update arduino app_lab to version 0.4.0 or later.

Affected software

Vendor	Product	Affected versions
arduino	app_lab	< 0.4.0 `cpe:2.3:a:arduino:app_lab::::::::`

Original advisory text

Arduino App Lab has Improper Data Validation in Internal Terminal Interface

Arduino App Lab is a cross-platform IDE for developing Arduino Apps. Prior to 0.4.0, a vulnerability was identified in the Terminal component of the arduino-app-lab application. The issue stems from insufficient sanitization and validation of input data received from connected hardware devices, specifically in the _info.Serial and _info.Address metadata fields. The problem occurs during device information handling. When a board is connected, the application collects identifying attributes to establish a terminal session. Because strict validation is not enforced for the Serial and Address parameters, an attacker with control over the connected hardware can supply specially crafted strings containing shell metacharacters. The exploitation requires direct physical access to a previously tampered board. When the host system processes these fields, any injected payload is executed with the privileges of the user running arduino-app-lab. This vulnerability is fixed in 0.4.0.

References

https://github.com/arduino/arduino-app-lab/releases/tag/al-0.4.0 URL
https://github.com/arduino/arduino-app-lab/security/advisories/GHSA-3652-939f-f7... Vendor Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25933... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-25933 Vendor Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

6.8 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-78OS Command Injection

Timeline

Published12 Feb 2026

Updated3 Nov 2026

First seen6 Mar 2026

Sources

CVE-2026-25933 · NVD

CVE-2026-25933 · OSV

GHSA-3652-939f-f7g4 · GHSA

Track software like this

Free during beta