CVE-2026-26514
High · 7.5CVSS
7.5
EPSS
0.7%
Published
Mar 4, 2026
CISA due date
—
The record
An Argument Injection vulnerability exists in bird-lg-go before commit 6187a4e. The traceroute module uses shlex.Split to parse user input without validation, allowing remote attackers to inject arbitrary flags (e.g., -w, -q) via the q parameter. This can be exploited to cause a Denial of Service (DoS) by exhausting system resources.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-112944 launch-editor allows users to open files with line numbers in editor from Node.js. CWE-88
- CVE-2026-112900 Pillow is a Python imaging library. CWE-88
- CVE-2026-105326 An argument injection flaw was found in CUPS. CWE-88
- CVE-2026-102827 simple-git, an interface for running git commands in any node.js application, enables… CWE-88
- CVE-2026-89066 Improper neutralization of special elements used in an OS command in the task synthesis… CWE-88
- CVE-2026-11765 Improper neutralization of argument delimiters in a command ('argument injection')… CWE-88
- CVE-2026-0304 A privilege escalation vulnerability in Palo Alto Networks Cortex XDR Broker VM enables… CWE-88
- CVE-2026-8044 CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument… CWE-88