CVE-2026-37281
published 2026-05-19CVE-2026-37281: An OS command injection vulnerability in the /stream-to-vlc Express route in hitarth-gg Zenshin before 2.7.0 allows remote attackers to execute arbitrary…
PriorityP270critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
1.62%
73.1th percentile
An OS command injection vulnerability in the /stream-to-vlc Express route in hitarth-gg Zenshin before 2.7.0 allows remote attackers to execute arbitrary commands via the url parameter.
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
hitarth-gg Zenshin up to 2.6.x Parameter /stream-to-vlc url os command injection
vuldb·2026-05-19
CVE-2026-37281 [CRITICAL] hitarth-gg Zenshin up to 2.6.x Parameter /stream-to-vlc url os command injection
A vulnerability, which was classified as critical, was found in hitarth-gg Zenshin up to 2.6.x. This affects an unknown function of the file /stream-to-vlc of the component Parameter Handler. Executing a manipulation of the argument url can lead to os command injection.
This vulnerability is tracked as CVE-2026-37281. The attack can be launched remotely. No exploit exists.
You should upgrade the affected component.
GHSA
GHSA-m4v3-5453-5w8r: An OS command injection vulnerability in the /stream-to-vlc Express route in hitarth-gg Zenshin before 2
ghsa_unreviewed·2026-05-19
CVE-2026-37281 [CRITICAL] CWE-78 GHSA-m4v3-5453-5w8r: An OS command injection vulnerability in the /stream-to-vlc Express route in hitarth-gg Zenshin before 2
An OS command injection vulnerability in the /stream-to-vlc Express route in hitarth-gg Zenshin before 2.7.0 allows remote attackers to execute arbitrary commands via the url parameter.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-05-19
Published