{
  "ticket_id": "CVE-2026-37281",
  "code_root": "external/zenshin",
  "source": {
    "type": "cve",
    "cve_id": "CVE-2026-37281",
    "vendor": "hitarth-gg",
    "product": "zenshin",
    "repo": "https://github.com/hitarth-gg/zenshin"
  },
  "facts": {
    "cve_id": "CVE-2026-37281",
    "issue_summary": "OS command injection in the zenshin Electron/Express application. The Express backend route '/stream-to-vlc' passes the 'url' query parameter into a shell command without sanitization. A crafted 'url' value injects and executes arbitrary shell commands on the host, enabling remote code execution.",
    "vulnerability_type": "OS Command Injection (Remote Code Execution)",
    "suspected_cwe": ["CWE-78"],
    "affected_versions": "< 2.7.0",
    "fixed_versions": ["2.7.0"],
    "reproduce_version": "commit immediately before 7d31c6edfbac978f0ad44c66d761bab9dcd2fa27",
    "verify_fixed_version": "2.7.0 (fix commit 7d31c6edfbac978f0ad44c66d761bab9dcd2fa27)",
    "repo_url": "https://github.com/hitarth-gg/zenshin.git",
    "fix_commit": "7d31c6edfbac978f0ad44c66d761bab9dcd2fa27",
    "code_root": "external/zenshin",
    "language": "JavaScript",
    "runtime": "Node.js (Express backend within an Electron app)",
    "vulnerable_endpoint": "GET /stream-to-vlc?url=<value>",
    "attacker_access": "Any actor able to reach the local Express backend HTTP port can issue the request unauthenticated.",
    "exploit_outline": "Start the Express backend, then send GET /stream-to-vlc with a 'url' query parameter carrying a shell metacharacter and a command, e.g. url=;touch /tmp/pwned. The unsanitized value is concatenated into a shell command and executed.",
    "vulnerable_indicator": "On the pre-fix commit, after `curl 'http://localhost:<port>/stream-to-vlc?url=;touch /tmp/pwned'` the file /tmp/pwned exists - the injected command ran.",
    "fixed_indicator": "On the fix commit 7d31c6edfbac978f0ad44c66d761bab9dcd2fa27, the same request does not create /tmp/pwned - the injected command did not run.",
    "reproduction_requirements": "Node.js, the zenshin repository checked out at the two refs, npm to install backend dependencies, and the Express backend started so its HTTP port is reachable. The reproduction only exercises the backend route via curl; the Electron front-end is not required.",
    "notes": "There is no GHSA for this CVE. The repro pins exact refs via the fix commit: check out the parent of 7d31c6edfbac978f0ad44c66d761bab9dcd2fa27 for the vulnerable build and 7d31c6edfbac978f0ad44c66d761bab9dcd2fa27 itself for the fixed build. Use a sentinel file (/tmp/pwned) as the unambiguous observable indicator."
  }
}