CVE-2026-5208: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in coolercontrold

Severity: high (CVSS 7.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-04-08 · updated 2026-10-23
Weakness: CWE-78

Description

Command injection in alerts in CoolerControl/coolercontrold <4.0.0 allows authenticated attackers to execute arbitrary code as root via injected bash commands in alert names

Affected products

coolercontrold: from 3.1.0 through 4.0.0

References

https://gitlab.com/coolercontrol/coolercontrol/-/blob/3.1.0/coolercontrold/src/alerts.rs?ref_type=tags#L576
https://gitlab.com/coolercontrol/coolercontrol/-/releases/4.0.0

Get alerted when CVE-2026-5208 or the next vulnerability affects your stack