CVE-2026-65184
CRITICAL
NVD
CVSS Score
9.8
Severity
CRITICAL
Published
Oct 26, 2026
Vendor
unknown
Description
The root-privileged `wsserver` terminal-bridge daemon builds a shell command from client-supplied WebSocket fields and passes it to `system()` and `popen()` without quoting, escaping, or character-set validation. The daemon's public-key session path performs no appliance-session check.