CVE-2026-112159— JumpServer Template Rendering os command injection
Quick assessment
Affected
n/a JumpServer
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 JumpServer 4.10.19 及更早版本中发现了一个安全漏洞。受影响的部分是“模板渲染”组件中的一个未知功能。通过操纵 IP/HOST 参数，可触发操作系统命令注入漏洞。该漏洞可被远程利用，且利用方法已在公开渠道披露，存在被实际攻击的风险。升级至 5.0.0 版本即可修复此问题。相关补丁的标识符为：fcf2904cdb884230e9676f50f37a44d09fa97040。建议立即升级受影响组件。厂商确认：“该问题早在数月前已被发现，并已在 v5 分支中修复。（……）该修复也将包含在即将发布的 v
Affected Version Matrix 21
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| n/a | JumpServer | 4.10.0 |
affected |
4.10.1 |
affected | ||
4.10.2 |
affected | ||
4.10.3 |
affected | ||
4.10.4 |
affected | ||
4.10.5 |
affected | ||
4.10.6 |
affected | ||
4.10.7 |
affected | ||
| … +13 more rows | |||
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-112159
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
JumpServer Template Rendering os command injection
Source: CVE Program / CVE List V5
Vulnerability Description
A security vulnerability has been detected in JumpServer up to 4.10.19. The affected element is an unknown function of the component Template Rendering. The manipulation of the argument IP/HOST leads to os command injection. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. Upgrading to version 5.0.0 is sufficient to fix this issue. The identifier of the patch is fcf2904cdb884230e9676f50f37a44d09fa97040. The affected component should be upgraded. The vendor confirms: "This issue was identified quite some time ago, and we have already fixed it in the v5 branch. (...) The fix will also be included in an upcoming v4 release.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
OS命令中使用的特殊元素转义处理不恰当(OS命令注入)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| - | JumpServer | 4.10.0 |
cpe:2.3:a:jumpserver:jumpserver:*:*:*:*:*:*:*:*
|
|
II. Public POCs for CVE-2026-112159
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-112159
请登录查看更多情报信息。
Proof of Concept for CVE-2026-112159 (1)
-
CVE-2026-112159 | JumpServer up to 4.10.19 Template Rendering IP/HOST os command injection vdb-entry technical-description
Other References for CVE-2026-112159 (8)
-
-
https://vuldb.com/cve/CVE-2026-112159 third-party-advisory
-
-
https://vuldb.com/submit/964676 third-party-advisory
Same Patch Batch · n/a · 2026-10-19 · 17 CVEs total
| CVE-2026-112361 | 6.3 MEDIUM | Dolibarr CSP document.php protection mechanism |
| CVE-2026-112098 | 6.3 MEDIUM | DeepPavlov Config Reference Resolver params.py resolve code injection |
| CVE-2026-112086 | 6.3 MEDIUM | ESPnet Inference Model inference_model.py build_model deserialization |
| CVE-2026-112100 | 5.5 MEDIUM | DeepPavlov multitask_preprocessor.py MultiTaskPipelinePreprocessor.__init__ code injection |
| CVE-2026-112045 | 5.4 MEDIUM | donetick History Deletion model.go CanDeleteHistory improper authorization |
| CVE-2026-112195 | 4.7 MEDIUM | FusionPBX Dialplan Editor dialplan.php os command injection |
| CVE-2026-38671 | Ellucian Banner 9.23 及以下版本跨站脚本漏洞 | |
| CVE-2026-107081 | SLiMS 9.8.0 管理员接口表名参数 SQL 注入漏洞 | |
| CVE-2026-107082 | Slims 9.8.0 SQL 注入漏洞 | |
| CVE-2026-107083 | SLiMS Bulian 9.8.0 dl_detail.php SQL 注入漏洞 | |
| CVE-2026-107084 | Slims 9.8.0 存在 CSRF 漏洞致借阅记录丢失 | |
| CVE-2025-52290 | Ffmpeg N-119856 空指针解引用导致拒绝服务 | |
| CVE-2025-55654 | GPAC MP4Box v2.4 使用已释放内存漏洞 | |
| CVE-2025-60480 | MP4Box 2.5 堆缓冲区溢出导致拒绝服务漏洞 | |
| CVE-2025-55667 | GPAC MP4Box v2.5-DEV 拒绝服务漏洞 | |
| CVE-2025-60482 | MP4Box 2.5 堆释放后使用漏洞致拒绝服务 |
IV. Related Vulnerabilities
Same product: JumpServer
-
CVE-2026-104126
JumpServer: Ansible Automation Template Rendering Allows Uns -
CVE-2026-44846
JumpServer: Privilege Overwrite via Organization Invite Logi -
CVE-2026-44845
JumpServer: Remote Command Execution (RCE) via Jinja Templat -
CVE-2026-54336
JumpServer: KoKo Web Terminal SFTP Path Traversal on Authori -
CVE-2026-31864
JumpServer has a Server-Side Template Injection Leading to R
Same vendor: n/a
-
CVE-2026-112361
Dolibarr CSP document.php protection mechanism -
CVE-2026-112195
FusionPBX Dialplan Editor dialplan.php os command injection -
CVE-2026-112100
DeepPavlov multitask_preprocessor.py MultiTaskPipelinePrepro -
CVE-2026-112098
DeepPavlov Config Reference Resolver params.py resolve code -
CVE-2026-112086
ESPnet Inference Model inference_model.py build_model deseri
Same weakness: CWE-78
-
CVE-2026-112370
H3C Magic NX15 usrlist sub_416874 os command injection -
CVE-2026-112900
Pillow: Argument Injection in Ghostscript call, potentially -
CVE-2026-112301
orbitale imagemagick-php Command.php font os command injecti -
CVE-2026-112195
FusionPBX Dialplan Editor dialplan.php os command injection -
CVE-2026-103038
PingTools Network Utilities 4.64 - OS command injection thro
V. Comments for CVE-2026-112159
No comments yet