CVE-2026-112159 | JumpServer up to 4.10.19 Template Rendering IP/HOST os command injection

October 19, 2026 Yanac

A vulnerability has been found in JumpServer up to 4.10.19 and classified as problematic. The affected element is an unknown function of the component Template Rendering. The manipulation of the argument IP/HOST leads to os command injection.

This vulnerability is referenced as CVE-2026-112159. Remote exploitation of the attack is possible. Furthermore, an exploit is available.

The affected component should be upgraded.

The vendor confirms: “This issue was identified quite some time ago, and we have already fixed it in the v5 branch. (…) The fix will also be included in an upcoming v4 release.VulDB Recent EntriesRead More