CVE-2026-105487 | yogeshojha reNgine up to 2.2.0 listTargets Endpoint web/reNgine/tasks.py subdomain_discovery name os command injection (Issue 1561)

October 5, 2026 Yanac

A vulnerability was found in yogeshojha reNgine up to 2.2.0. It has been declared as critical. Affected by this vulnerability is the function subdomain_discovery of the file web/reNgine/tasks.py of the component listTargets Endpoint. The manipulation of the argument Name results in os command injection.

This vulnerability is reported as CVE-2026-105487. The attack can be launched remotely. Moreover, an exploit is present.

The pull request to fix this issue awaits acceptance.VulDB Recent EntriesRead More