CVE-2026-105487

Executive Summary

CVE-2026-105487 is an OS command injection vulnerability (CWE-77) in yogeshojha reNgine up to version 2.2.0, affecting the subdomain_discovery function within the web/reNgine/tasks.py file, exposed through the listTargets endpoint. An authenticated remote attacker can manipulate the Name argument to inject and execute arbitrary operating system commands on the host running reNgine. With a CVSS score of 6.3, a public exploit available, and no accepted vendor patch, organizations running reNgine for reconnaissance and attack surface management should treat this as an actively exploitable risk requiring immediate mitigation.

Technical Analysis

reNgine is an open-source reconnaissance framework used for automated subdomain discovery, scanning, and attack surface mapping. The vulnerability resides in the web/reNgine/tasks.py module, specifically in the subdomain_discovery function, which is invoked via the listTargets endpoint. The flaw is classified as CWE-77 (Improper Neutralization of Special Elements used in a Command), indicating that attacker-controlled input is passed to a system command without adequate sanitization.

The attack surface is the Name argument, which the application accepts and incorporates into a shell command executed by the underlying operating system. Because the argument is not properly neutralized before command construction, an attacker who can supply a crafted Name value can append or embed shell metacharacters that alter the intended command, resulting in arbitrary command execution in the context of the reNgine process.

Key characteristics derivable from the available data:

• Attack vector: Network (AV:N) — the vulnerable endpoint is remotely reachable.
• Privileges required: Low (PR:L) — the attacker must be able to reach the listTargets functionality, implying at minimum a low-privileged authenticated session.
• User interaction: None (UI:N) — no victim action is required.
• Scope: Unchanged (S:U) — exploitation impacts only the reNgine host and its resources.
• Confidentiality/Integrity/Availability: All Low (C:L/I:L/A:L) — command execution grants the attacker access to read, modify, and disrupt resources available to the reNgine service account, though the CVSS reflects limited direct system-wide impact.

The public disclosure of an exploit drastically lowers the barrier to entry, and the pending status of the fix pull request means no official patched release is currently available. Defenders cannot rely on vendor updates and must implement compensating controls.

Exploitation Scenarios

The attack chain follows a standard OS command injection pattern:

1. Reconnaissance / Target Identification: The attacker identifies an internet-exposed or internally accessible reNgine instance running version 2.2.0 or earlier. Shodan dorks such as http.title:"reNgine" or http.html:"reNgine" can be used to locate such deployments. The attacker confirms access to the listTargets endpoint, which may require a low-privileged authenticated session given the PR:L rating.

2. Triggering the Flaw Class: The attacker interacts with the listTargets endpoint and manipulates the Name argument with a value containing shell metacharacters. In OS command injection, this typically involves characters such as ;, |, &, $(), or backticks that terminate the intended command and introduce an attacker-supplied command. The subdomain_discovery function in web/reNgine/tasks.py then constructs a system command incorporating this unsanitized Name value, and the shell executes the injected command.

3. Payload / Execution Method: At the vulnerability-class level, the injected OS command executes with the privileges of the reNgine service process. Common objectives include spawning a reverse shell, downloading and executing a secondary payload, or executing reconnaissance commands. No public exploit code details are available from the provided data; the attack chain is inferred from the OS command injection vulnerability class and the confirmed public exploit status.

4. Post-Exploitation Impact: Successful exploitation yields arbitrary command execution on the reNgine host. The attacker can exfiltrate scan data, stored credentials, and configuration; pivot to internal networks reachable from the host; establish persistence; or disrupt reconnaissance operations. Because reNgine often runs with access to sensitive target lists and API keys, compromise can cascade into downstream systems.

No public PoC code is included in this dataset; the attack chain is inferred from the vulnerability class and the reported public exploit.

Impact Assessment

The CVSS v3.1 base score is 6.3 (Medium), reflecting an exploitable but constrained impact profile. The confidentiality, integrity, and availability impacts are each rated Low, meaning the attacker can access some data, modify some data, and cause some disruption, but does not achieve full system control with high certainty from the vulnerability alone. The network attack vector and low privilege requirement make exploitation practical for attackers with any foothold into the reNgine interface.

Business impact centers on:

• Data exposure: reNgine aggregates reconnaissance data, including subdomains, endpoints, and potentially credentials or API tokens for integrated services (e.g., Shodan, Censys, cloud providers). Command injection can exfiltrate this data.
• Lateral movement: The host running reNgine often resides in a network segment with access to internal targets, enabling pivoting.
• Operational disruption: Attackers can terminate processes, delete scan results, or deploy ransomware, degrading an organization's security assessment capability.
• Blast radius: Any deployment of reNgine 2.2.0 or earlier that exposes the listTargets endpoint to untrusted networks is at risk. The lack of CISA KEV listing and EPSS scoring means many organizations may not prioritize it, increasing the window of exposure.

Detection Guidance

Sigma Rule

title: Potential reNgine OS Command Injection via listTargets Endpoint
id: 8f3b2c1a-4d5e-6f7a-8b9c-0d1e2f3a4b5c
status: experimental
description: Detects command injection attempts against the reNgine listTargets endpoint through shell metacharacters in the Name argument.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-105487
author: valtersit.com
date: 2026-01-01
logsource:
  category: webserver
detection:
  selection_endpoint:
    cs-uri-query|contains:
      - '/listTargets'
      - 'listTargets'
  selection_payload:
    cs-uri-query|contains:
      - ';'
      - '|'
      - '&&'
      - '`'
      - '$('
      - 'Name='
  condition: selection_endpoint and selection_payload
falsepositives:
  - Legitimate use of semicolons or pipes in target names (unlikely)
level: high
tags:
  - attack.t1190
  - attack.t1059

YARA Rule

rule CVE_2026_105487_reNgine_CMDInjection
{
    meta:
        description = "Detects command injection patterns targeting reNgine listTargets Name argument"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-105487"
        date = "2026-01-01"
        severity = "high"

    strings:
        $endpoint = "listTargets" ascii wide nocase
        $fn = "subdomain_discovery" ascii wide
        $meta1 = ";" ascii
        $meta2 = "|" ascii
        $meta3 = "$(" ascii
        $meta4 = "`" ascii
        $shell1 = "/bin/sh" ascii
        $shell2 = "bash -c" ascii

    condition:
        $endpoint and $fn and any of ($meta*) and 1 of ($shell*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-105487 reNgine listTargets OS Command Injection Attempt"; flow:to_server,established; http.uri; content:"listTargets"; http.uri; content:"Name="; pcre:"/Name=[^&]*[;|`]|Name=[^&]*\$\(/i"; reference:cve,2026-105487; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-105487; classtype:web-application-attack; sid:2026105487; rev:1;)

Elastic Detection

network where
  http.request.method == "GET" and
  stringContains(http.request.uri, "listTargets") and
  (stringContains(http.request.uri, "Name=") and
   (stringContains(http.request.uri, ";") or
    stringContains(http.request.uri, "|") or
    stringContains(http.request.uri, "`") or
    stringContains(http.request.uri, "$(")))

Splunk SPL Query

index=web OR index=proxy
| search (uri="*listTargets*" OR url="*listTargets*")
| search (uri="*Name=*" OR url="*Name=*")
| regex uri="(;|\||`|\$\(|%3B|%7C|%60)"
| stats count min(_time) as first_seen max(_time) as last_seen values(src_ip) as source_ips by uri, host, status
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="rengine,web,attack,">
  <rule id="100487" level="12">
    <if_sid>31100,31101,31108</if_sid>
    <field name="url">listTargets</field>
    <field name="url">Name=</field>
    <regex type="pcre2">Name=[^&]*(;|\||`|\$\(|%3B|%7C|%60)</regex>
    <description>CVE-2026-105487: Possible reNgine OS command injection via listTargets Name argument</description>
    <mitre>
      <id>T1190</id>
      <id>T1059</id>
    </mitre>
    <group>rengine_web,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate Mitigations:

   • Restrict network access to the reNgine web interface and the listTargets endpoint using firewall rules, VPN, or IP allow-listing. Do not expose reNgine to the public internet.
   • Enforce strong authentication and the principle of least privilege for all reNgine accounts; the vulnerability requires low privileges, so limit who can access target management functionality.
   • Implement a Web Application Firewall (WAF) with rules that block shell metacharacters (;, |, &, `, $()) in the Name parameter and other query strings targeting the listTargets endpoint.
   • Monitor for outbound connections from the reNgine host that may indicate a reverse shell or command-and-control callback.

2. Patch / Upgrade Steps:

   • No official patched release is currently available; a fix pull request awaits acceptance upstream. Monitor the yogeshojha reNgine GitHub repository for a merged fix and subsequent release.
   • Once a patched version is released, test in a staging environment and upgrade promptly. Verify the fix neutralizes shell metacharacter input in the Name argument of subdomain_discovery.
   • As a stopgap, review and harden the subdomain_discovery function in web/reNgine/tasks.py to use safe command invocation (e.g., argument passing without a shell) if your team maintains a fork.

3. Long-Term Hardening:

   • Run reNgine in an isolated segmented network with minimal outbound access and no credentials to sensitive downstream systems.
   • Apply the principle of least privilege to the reNgine service account on the host.
   • Integrate SAST and dependency scanning into CI/CD for custom code that shells out with user-controlled input.
   • Maintain an inventory of internet-exposed reconnaissance tooling and periodically scan for known vulnerabilities.

References

• NVD — CVE-2026-105487: https://nvd.nist.gov/vuln/detail/CVE-2026-105487
• yogeshojha reNgine GitHub repository: https://github.com/yogeshojha/reNgine
• MITRE CWE-77 — Improper Neutralization of Special Elements used in a Command: https://cwe.mitre.org/data/definitions/77.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• FIRST EPSS — not yet scored for this CVE: https://www.first.org/epss/

No CISA KEV listing, no confirmed in-the-wild exploitation evidence, and no attributed threat actor campaigns were identified in the provided data. A public exploit is reported by the NVD description; specific exploit code is not included in this dataset.