CVE-2026-112077 | radareorg radare2 6.2.0/6.2.2 HTTP Sandbox Policy libr/core/rtr_http.inc.c r_core_cmd_str_pipe protection mechanism (Issue 26861)

A vulnerability was found in radareorg radare2 6.2.0/6.2.2. It has been classified as problematic. This issue affects the function r_core_cmd_str_pipe in the library libr/core/rtr_http.inc.c of the component HTTP Sandbox Policy Handler. Performing a manipulation results in protection mechanism failure.

This vulnerability is known as CVE-2026-112077. Remote exploitation of the attack is possible. No exploit is available.

Upgrading the affected component is recommended.

The pre-requisite of the vulnerability is reflected by the CVSS vector. One of the project maintainers explains: “There is a real sandbox configuration issue here, but the report overstates it. The HTTP server defaults to http.sandbox=true, so commands received through /cmd temporarily enable cfg.sandbox. However, cfg.sandbox.grain defaults to all, which means all sandbox capabilities – including exec – remain allowed. Therefore enabling the HTTP sandbox alone does NOT prevent commands from spawning processes. This only matters when the HTTP command endpoint is reachable by someone you do not trust. It is not a remote vulnerability by default: the HTTP server must first be started and exposed to the attacker.”VulDB Recent EntriesRead More