CVE-2026-59561

OS Command Injection in Sakura Editor Allows Arbitrary Command Execution via Open Terminal

Published Aug 24, 2026 CVSS 4.0 · 8.4 High EPSS 1.1% KEV · Not listed

Description

Sakura Editor provided by Sakura Editor Development Community contains an OS command injection vulnerability. If a victim user is directed to edit a file in a crafted directory, arbitrary OS command may be executed on the user's PC when the user invokes "Open Terminal".

Analysis

Technical impact

The vulnerability is an OS command injection flaw in Sakura Editor. When a user opens a file from a directory crafted by an attacker, the application performs command execution through the built‑in "Open Terminal" feature, allowing arbitrary OS commands to run with the user's privileges. This matches CWE‑78 and could result in full compromise of the affected machine.

Affected Systems

Affected parties include users of Sakura Editor from the Sakura Editor Development Community. The CVE data does not specify affected versions.

Risk and Exploitability

The CVSS score of 8.4 classifies this as a High‑severity flaw. Although EPSS data is not available, the lack of a KEV listing suggests no known widespread exploitation yet, yet the exploit path only requires a local user to open a terminal after visiting a malicious directory. Administrators should treat this as a likely local code execution risk and apply the patch promptly.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Sakura Editor Development Community

Sakura Editor

unaffected

Version	Status	Constraints
`0`	affected	< 2.4.3

No data.

Vendor Product Versions

Sakura-editor

Sakura

Version	Status	Scheme	Platform
`[0,2.4.3)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Visit the Sakura Editor Development Community website or advisories to locate a patch or update that addresses this flaw.
Avoid using the "Open Terminal" feature when editing files from directories that may not be fully trusted.
Consider disabling the "Open Terminal" function or restricting user rights if updating is not feasible.

Generated by OpenCVE AI on August 24, 2026 at 06:51 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Local

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction Active

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: 1.1% (1.086% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://github.com/sakura-editor/sakura/releases/tag/v2.4.3
https://github.com/sakura-editor/sakura/security/advisories/GHSA-6x2x-729r-wjh5
https://jvn.jp/en/jp/JVN74538868/

History

Aug 26, 2026 7:30 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Aug 24, 2026 9:30 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Sakura-editor Sakura-editor sakura
Vendors & Products		Sakura-editor Sakura-editor sakura

Aug 24, 2026 7:15 AM Title updated View changes

Type	Values Removed	Values Added
Title		OS Command Injection in Sakura Editor Allows Arbitrary Command Execution via Open Terminal

Aug 24, 2026 5:15 AM Description updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Sakura Editor provided by Sakura Editor Development Community contains an OS command injection vulnerability. If a victim user is directed to edit a file in a crafted directory, arbitrary OS command may be executed on the user's PC when the user invokes "Open Terminal".
Weaknesses		CWE-78
References		https://github.com/sakura-editor/sakura/releases/tag/v2.4.3 https://github.com/sakura-editor/sakura/security/advisories/GHSA-6x2x-729r-wjh5 https://jvn.jp/en/jp/JVN74538868/
Metrics		cvssV3_0 `{'score': 7.8, 'vector': 'CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}` cvssV4_0 `{'score': 8.4, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}`