https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-08T18:39:33.283104+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-39866 CVE-2026-39866 — Lawnchair vulnerable to Command Injection via unquoted workflow dispatch input in release_update.yml 2026-10-08T18:39:33.299531+00:00

Affected: LawnchairLauncher lawnchair

Lawnchair is a free, open-source home app for Android. Prior to commit fcba413f55dd47f8a3921445252849126c6266b2, command injection in release_update.yml workflow dispatch input allows arbitrary code execution. Commit fcba413f55dd47f8a3921445252849126c6266b2 patches the issue.