A flaw in the listTargets endpoint of yogeshojha reNgine allows an attacker to inject arbitrary commands through the Name argument supplied to the subdomain_discovery task. The command injection is based on OS command handling (CWE-77/CWE-78) and enables the attacker to run arbitrary system commands on the host where reNgine is deployed. The vulnerability is triggered by a remote request and the code does not perform any input validation or escaping of the supplied argument.

All installations of yogeshojha reNgine version 2.2.0 or earlier are affected. The flaw resides in the web/reNgine/tasks.py file under the listTargets endpoint and is exercised when the subdomain_discovery task processes the Name parameter.

The CVSS score of 5.3 indicates moderate severity, and the vulnerability is not currently tracked in the CISA KEV catalog. The EPSS score of 1% indicates a low but nonzero likelihood of exploitation. Because the attack vector is remote and the vulnerability exploits OS command injection, an attacker could gain system-level privileges on the reNgine host if the process runs with elevated rights or can further compromise the environment. As the fix is pending acceptance of a pull request, remediation is not yet available via an official patch and the only mitigation steps are temporary measures until a corrected release is issued.