CVE-2026-100230
Quick assessment
Affected
input-leap Input Leap
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Input Leap（又称 input-leap）3.0.3 及之前的版本，在 Windows 或 macOS 上使用非默认启用拖放功能（--enable-drag-drop）选项时，未能正确处理正斜杠（/）与反斜杠（\）的区别，从而导致目录遍历漏洞。如果文件被写入到启动目录，则可能引发任意代码执行。该漏洞可通过 DDRG 消息触发。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-100230
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
Input Leap (aka input-leap) through 3.0.3, when the non-default --enable-drag-drop option is used on Windows or macOS, mishandles the / versus \ distinction and allows directory traversal, with resultant code execution if a file is written to a startup directory. This occurs via a DDRG message.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
不正确的行为次序：规范化之前验证
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| input-leap | Input Leap | 0 ~ 3.0.3 | - |
|
II. Public POCs for CVE-2026-100230
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-100230
请登录查看更多情报信息。
Mailing List Discussions for CVE-2026-100230 (1)
Other References for CVE-2026-100230 (9)
-
https://raw.githubusercontent.com/input-leap/input-leap/master/src/lib/inputleap/ArgParser.cpp technical-description product
-
https://github.com/input-leap/input-leap/blob/v3.0.3/src/lib/inputleap/DragInformation.cpp technical-description product
-
-
https://raw.githubusercontent.com/input-leap/input-leap/v3.0.3/src/lib/server/Server.cpp technical-description product
-
https://raw.githubusercontent.com/debauchee/barrier/master/src/lib/barrier/DragInformation.cpp technical-description related
-
https://raw.githubusercontent.com/input-leap/input-leap/master/src/lib/net/SecureSocket.cpp technical-description product
-
https://github.com/input-leap/input-leap/blob/master/src/lib/inputleap/DropHelper.cpp technical-description product
IV. Related Vulnerabilities
Same weakness: CWE-180
-
CVE-2026-100674
stoatchat before 0.15.5 Username Validation Bypass via Unico -
CVE-2026-100547
OpenClaw before 2026.8.1 Authentication Bypass via File URL -
CVE-2026-97764
django-allauth <65.19.4 暴力破解漏洞 -
CVE-2026-90813
cosmicstack-labs mercury-agent Shell Command Execution permi -
CVE-2026-79300
SEP sesam 处理逻辑错误漏洞
V. Comments for CVE-2026-100230
No comments yet