https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T02:31:37.900014+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-57999 CVE-2026-57999 — luci-app-tailscale-community - Command Injection via tailscale.do_login RPC 2026-10-06T02:31:37.916213+00:00

Affected: openwrt luci-app-tailscale-community

luci-app-tailscale-community contains a command injection vulnerability in the tailscale.do_login RPC method that allows authenticated users to execute arbitrary commands as root. The vulnerability exists because user-controlled loginserver and loginserver_authkey parameters are improperly quoted within a double-quoted shell command, allowing shell substitutions like $() to be evaluated by the outer shell before argument processing.