What is GHSA-2h6c-w4mg-27v5?

GHSA-2h6c-w4mg-27v5 is a security advisory published by GitHub Security Advisories with High severity. In openNDS before 11.0.0, the client_params.sh script, invoked by the openNDS daemon to serve the...

Which CVE IDs does GHSA-2h6c-w4mg-27v5 cover?

GHSA-2h6c-w4mg-27v5 covers the following CVE IDs: CVE-2026-38822. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-2h6c-w4mg-27v5?

GHSA-2h6c-w4mg-27v5 has a CVSS v3 base score of 7.6, published by GitHub Security Advisories.

GHSA-2h6c-w4mg-27v5HighCVSS 7.6

In openNDS before 11.0.0, the client_params.sh script, invoked by the openNDS daemon to serve the...

Vendor

GitHub Security Advisories

Published

August 28, 2026

Last Modified

August 28, 2026

🔗 CVE IDs covered (1)

CVE-2026-38822 →

📋 Description

In openNDS before 11.0.0, the client_params.sh script, invoked by the openNDS daemon to serve the authenticated client status page, is vulnerable to OS command injection through crafted HTTP GET query parameter keys. An authenticated captive portal user can inject arbitrary shell commands by embedding semicolons in a URL query parameter name.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-38822
https://github.com/openNDS/openNDS/commit/294983e859bb678eef7db06fc9f6afab0b489d8e
https://github.com/advisories/GHSA-2h6c-w4mg-27v5