CVE-2026-23920 — OS Command Injection in Zabbix
Severity
7.7HIGHNVD
EPSS
0.1%
top 83.72%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedMar 24
Latest updateApr 6
Description
Host and event action script input is validated with a regex (set by the administrator), but the validation runs in multiline mode. If ^ and $ anchors are used in user input validation, an injected newline lets authenticated users bypass the check and inject shell commands.
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected Packages2 packages
🔴Vulnerability Details
4OSV
▶
CVEList▶
Host and event action script regex validation can be bypassed in certain situations, leading to potential command injection↗2026-03-24
GHSA▶
GHSA-2h5x-h7x4-hm9h: Host and event action script input is validated with a regex (set by the administrator), but the validation runs in multiline mode↗2026-03-24
OSV▶
CVE-2026-23920: Host and event action script input is validated with a regex (set by the administrator), but the validation runs in multiline mode↗2026-03-24
📋Vendor Advisories
1Debian▶
CVE-2026-23920: zabbix - Host and event action script input is validated with a regex (set by the adminis...↗2026