{"id":"CVE-2026-58000","summary":"luci-proto-openvpn - Command Injection via cl_meta Parameter in generateKey","details":"luci-proto-openvpn through 0.11.1, fixed in commit e4ff45e, contains a command injection vulnerability in the generateKey ubus method where the cl_meta parameter is interpolated into a shell command without proper escaping or quoting. An authenticated LuCI user with OpenVPN protocol configuration access can inject arbitrary shell metacharacters into cl_meta to execute commands as root via the popen function.","aliases":["GHSA-pm9w-522m-8rrh"],"modified":"2026-08-12T16:41:33.798973Z","published":"2026-06-29T18:16:04.973Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/58xxx/CVE-2026-58000.json","cna_assigner":"VulnCheck","cwe_ids":["CWE-78"]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/58xxx/CVE-2026-58000.json"},{"type":"ADVISORY","url":"https://github.com/openwrt/luci/security/advisories/GHSA-pm9w-522m-8rrh"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58000"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/luci-proto-openvpn-command-injection-via-cl-meta-parameter-in-generatekey"},{"type":"FIX","url":"https://github.com/openwrt/luci/commit/e4ff45ecbc6ad212951815c8c99b2749fbd7de6b"},{"type":"PACKAGE","url":"https://github.com/openwrt/luci"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/openwrt/luci","events":[{"introduced":"0"},{"fixed":"adc4c2932ec7039a6b7effeace098e5bc46861c6"},{"fixed":"e4ff45ecbc6ad212951815c8c99b2749fbd7de6b"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"0.11.1"}],"source":["DESCRIPTION","REFERENCES"]}}],"versions":["0.11.0"],"database_specific":{"vanir_signatures_modified":"2026-08-12T16:41:33Z","vanir_signatures":[{"signature_version":"v1","source":"https://github.com/openwrt/luci/commit/adc4c2932ec7039a6b7effeace098e5bc46861c6","target":{"file":"libs/web/src/po2lmo.c","function":"cmp_index"},"deprecated":false,"digest":{"function_hash":"267937982258194431500600583142452512006","length":275},"id":"CVE-2026-58000-2d5eb769","signature_type":"Function"},{"deprecated":false,"digest":{"function_hash":"252882516357346457311810025894045084359","length":1127},"id":"CVE-2026-58000-32b46624","signature_type":"Function","signature_version":"v1","source":"https://github.com/openwrt/luci/commit/adc4c2932ec7039a6b7effeace098e5bc46861c6","target":{"file":"libs/web/src/template_lmo.c","function":"lmo_open"}},{"digest":{"threshold":0.9,"line_hashes":["255246143790764752263468115280959242700","275234442868348779508066300671235586565","298876392605505629757341239582167779991","63648796039497051509190760358021637159","231700784739263284885709230475785353172","171502405075970809609179068254291655255","287659827364578275683106832730264120728","266157800178906047088568469210620396817","139158802025619872971326869115177280153","57761734454291790089904071342416977654","163759932672886758421837429586971512615","152477519193259158422681683620746368844","218832914020503057235009219479145375369","130752406432287234203413602790812398018","134392294334258105636367093923781958156","29678459402679828907192032875888954664","56131625441151105134124795207078958965","333507731538656558476771378169086587368","100717214018980979579795712276017776861","172849280745304616561090909405221781094","189642627781276617987544728430484857630","331833475899029850516628542094478609937","258154515434547042347190663594787994631","68412638862159408427704358339124868530","170348445838925904224600793909725865444"]},"id":"CVE-2026-58000-52baa28f","signature_type":"Line","signature_version":"v1","source":"https://github.com/openwrt/luci/commit/adc4c2932ec7039a6b7effeace098e5bc46861c6","target":{"file":"libs/web/src/template_lmo.c"},"deprecated":false},{"source":"https://github.com/openwrt/luci/commit/adc4c2932ec7039a6b7effeace098e5bc46861c6","target":{"function":"print_index","file":"libs/web/src/po2lmo.c"},"deprecated":false,"digest":{"function_hash":"155277813017274838970720379419811512984","length":463},"id":"CVE-2026-58000-60bfa144","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"208471392475120797360726447137119308023","length":2334},"id":"CVE-2026-58000-6a2c1f50","signature_type":"Function","signature_version":"v1","source":"https://github.com/openwrt/luci/commit/adc4c2932ec7039a6b7effeace098e5bc46861c6","target":{"function":"main","file":"libs/web/src/po2lmo.c"}},{"signature_version":"v1","source":"https://github.com/openwrt/luci/commit/adc4c2932ec7039a6b7effeace098e5bc46861c6","target":{"file":"libs/web/src/template_lmo.c","function":"lmo_translate"},"deprecated":false,"digest":{"function_hash":"99854527991470356483642411122612102541","length":449},"id":"CVE-2026-58000-89201183","signature_type":"Function"},{"digest":{"line_hashes":["144561230986071348079710888038481586837","339125119656907809640888407608564846000","287410526688364895184924600398181402190","131867462700297383604664798023786887480","51963820585222883880242408473640046624","109106054087145048045335877668735774706","88777273850834081802722427872979618294","37821001619216981429006372506412560624","286687329754630689033448927948797535047","105168513588748326003621304767299186629","109625128140295335998475811736291577452","192537472347544377635438275961756972045","201160946251054775223105899865214492360","267736853800898291689885267742308071703","39348567944437703246817414919933731774","10972374964793075001928437096335639613","39289353252152317818375452559694585655","325465982018422423636926679534163992473","164212262644259844709738925336606535349","20902898861332164099246445727687163193","116890053089853706614014402158137153346","109188239162747433270995588429230074289","60562335353731525188801747724250614678","296956428085599957339045574956199420853","200494138348440971094632979948358492455","216715586464641420154270664597970839773","167096531428686979130326153209377242183"],"threshold":0.9},"id":"CVE-2026-58000-992fab73","signature_type":"Line","signature_version":"v1","source":"https://github.com/openwrt/luci/commit/adc4c2932ec7039a6b7effeace098e5bc46861c6","target":{"file":"libs/web/src/po2lmo.c"},"deprecated":false},{"digest":{"function_hash":"327959622269632693434154866840775274349","length":416},"id":"CVE-2026-58000-d86ec311","signature_type":"Function","signature_version":"v1","source":"https://github.com/openwrt/luci/commit/adc4c2932ec7039a6b7effeace098e5bc46861c6","target":{"file":"libs/web/src/template_lmo.c","function":"lmo_find_entry"},"deprecated":false}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-58000.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}]}