Description
A security vulnerability has been detected in JumpServer up to 4.10.19. The affected element is an unknown function of the component Template Rendering. The manipulation of the argument IP/HOST leads to os command injection. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. Upgrading to version 5.0.0 is sufficient to fix this issue. The identifier of the patch is fcf2904cdb884230e9676f50f37a44d09fa97040. The affected component should be upgraded. The vendor confirms: "This issue was identified quite some time ago, and we have already fixed it in the v5 branch. (...) The fix will also be included in an upcoming v4 release.
Published: 2026-10-19
Score: 5.1 Medium
EPSS: n/a
KEV: No
Impact: OS Command Injection
Action: Apply Patch
AI Analysis

Impact

The vulnerability lies in JumpServer’s Template Rendering component where an attacker can manipulate the IP/HOST argument to trigger operating system command injection. This flaw would allow the execution of arbitrary shell commands on the host, compromising confidentiality, integrity and availability of the system. It maps to CWE‑77 and CWE‑78.

Affected Systems

JumpServer JumpServer versions up to 4.10.19 are affected. The fix is delivered in version 5.0.0 and earlier releases will carry the patch identified by commit fcf2904cdb884230e9676f50f37a44d09fa97040.

Risk and Exploitability

With a CVSS score of 5.1 the issue is rated moderate, but remote exploitation is possible and an exploit has been publicly disclosed. The EPSS score is not reported and the vulnerability is not listed in the CISA KEV catalog, yet the publicly available exploit indicates a real risk. An attacker able to send crafted IP/HOST requests to the vulnerable endpoint can run arbitrary commands and potentially gain full system compromise.

Generated by OpenCVE AI on October 19, 2026 at 17:25 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade JumpServer to version 5.0.0 or later, which includes the patch commit fcf2904cdb884230e9676f50f37a44d09fa97040.
  • Restrict the use of the IP/HOST parameter so that only authenticated users with appropriate privileges can supply it, or disable the affected API endpoint if it is not required.
  • After the upgrade, monitor system logs for unexpected command execution and verify that no unauthorized commands are running.

Generated by OpenCVE AI on October 19, 2026 at 17:25 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 19 Oct 2026 16:30:00 +0000

Type Values Removed Values Added
Description A security vulnerability has been detected in JumpServer up to 4.10.19. The affected element is an unknown function of the component Template Rendering. The manipulation of the argument IP/HOST leads to os command injection. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. Upgrading to version 5.0.0 is sufficient to fix this issue. The identifier of the patch is fcf2904cdb884230e9676f50f37a44d09fa97040. The affected component should be upgraded. The vendor confirms: "This issue was identified quite some time ago, and we have already fixed it in the v5 branch. (...) The fix will also be included in an upcoming v4 release.
Title JumpServer Template Rendering os command injection
First Time appeared Jumpserver
Jumpserver jumpserver
Weaknesses CWE-77
CWE-78
CPEs cpe:2.3:a:jumpserver:jumpserver:*:*:*:*:*:*:*:*
Vendors & Products Jumpserver
Jumpserver jumpserver
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C'}

cvssV3_0

{'score': 5.5, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C'}

cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C'}

cvssV4_0

{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Jumpserver Jumpserver
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-19T16:15:17.871Z

Reserved: 2026-10-19T07:24:35.792Z

Link: CVE-2026-112159

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-19T17:17:13.947

Modified: 2026-10-19T17:17:13.947

Link: CVE-2026-112159

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-19T17:30:13Z

Weaknesses
  • CWE-77

    Improper Neutralization of Special Elements used in a Command ('Command Injection')

  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')