{"id":"CVE-2026-68502","summary":"LazyOwn: Unauthenticated Socket.IO `input` Event Reaches LazyOwn Command Dispatcher — Unauthenticated RCE","details":"LazyOwn RedTeam/APT Framework is an AI-powered C2 and red-team operations framework. Prior to 0.2.154, LazyOwn's lazyc2.py registers an unauthenticated Socket.IO input event handler that dispatches data.get('value') to LazyOwnShell.one_cmd, reaching LazyOwnShell.do_cmd and subprocess.call(command, shell=True), allowing unauthenticated remote code execution in the C2 process. This issue is fixed in 0.2.154.","aliases":["GHSA-fr84-8cfg-59w4"],"modified":"2026-08-02T03:32:16.174065937Z","published":"2026-07-30T20:38:05.485Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-306"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68502.json"},"references":[{"type":"WEB","url":"https://github.com/grisuno/LazyOwn/releases/tag/release/0.2.154"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68502.json"},{"type":"ADVISORY","url":"https://github.com/grisuno/LazyOwn/security/advisories/GHSA-fr84-8cfg-59w4"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68502"},{"type":"FIX","url":"https://github.com/grisuno/LazyOwn/commit/2e1e3a7b5da8149ae28a970b5883aefa42921652"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/grisuno/lazyown","events":[{"introduced":"0"},{"fixed":"2e1e3a7b5da8149ae28a970b5883aefa42921652"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"0.2.154"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["release/0.2.153","release/0.2.152","release/0.2.151","release/0.2.150","release/0.2.149","release/0.2.148","release/0.2.147","release/0.2.146","release/0.2.145","release/0.2.144","release/0.2.142","release/0.2.141","release/0.2.140","release/0.2.139","release/0.2.138","release/0.2.137","release/0.2.135","release/0.2.134","release/0.2.133","release/0.2.132","release/0.2.131","release/0.2.130","release/0.2.129","release/0.2.128","release/0.2.127","release/0.2.126","release/0.2.125","release/0.2.124","release/0.2.123","release/0.2.122","release/0.2.121","release/0.2.120","release/0.2.119","release/0.2.118","release/0.2.117","release/0.2.116","release/0.2.115","release/0.2.114","release/0.2.113","release/0.2.112","release/0.2.111","release/0.2.110","release/0.2.109","release/0.2.108","release/0.2.107","release/0.2.106","release/0.2.105","release/0.2.104","release/0.2.103","release/0.2.100","release/0.2.99","release/0.2.98","release/0.2.97","release/0.2.96","release/0.2.95","release/0.2.94","release/0.2.93","release/0.2.92","release/0.2.91","release/0.2.90","release/0.2.88","release/0.2.86","release/0.2.81","release/0.2.80","release/0.2.79","release/0.2.78","release/0.2.77","release/0.2.76","release/0.2.75","release/0.2.74","release/0.2.73","release/0.2.67","release/0.2.66","release/0.2.64","release/0.2.63","release/0.2.62","release/0.2.61","release/0.2.60","release/0.2.59","release/0.2.58","release/0.2.57","release/0.2.56","release/0.2.55","release/0.2.54","release/0.2.53","release/0.2.52","release/0.2.51","release/0.2.50","release/0.2.49","release/0.2.48","release/0.2.47","release/0.2.46","release/0.2.45","release/0.2.43","release/0.2.42","release/0.2.41","release/0.2.40","release/0.2.39","release/0.2.38","release/0.2.37","release/0.2.36","release/0.2.35","release/0.2.34","release/0.2.33","release/0.2.30","release/0.2.29","release/0.2.28","release/0.2.27","release/0.2.26","release/0.2.25","release/0.2.24","release/0.2.23","release/0.2.22","release/0.2.21","release/0.2.20","release/0.2.19","release/0.2.18","release/0.2.17","release/0.2.16","release/0.2.15","release/0.2.14","release/0.2.13","release/0.2.12","vvvrelease/0.2.11","vvvrelease/0.2.10","vvvrelease/0.2.9","vvvrelease/0.2.8","vvvrelease/0.2.7","vvvrelease/0.2.6","vvvrelease/0.2.5","vvvrelease/0.2.4","vvvrelease/0.2.3","vvvrelease/0.2.2","vvvrelease/0.2.1","vvvrelease/0.2.0","vvvrelease/0.1.2","vvvrelease/0.1.1","vvvrelease/0.1.0","vvvrelease/0.0.0","vvrelease/0.0.0","vrelease/0.0.0","release/0.0.0","release/0.1.66","release/0.1.65","release/0.1.64","release/0.1.63","release/0.1.62","release/0.1.61","release/0.1.60","release/0.1.59","release/0.1.58","release/0.1.57","release/0.1.56","release/0.1.55","release/0.1.54","release/0.1.53","release/0.1.52","release/0.1.51","release/0.1.50","release/0.1.49","release/0.1.48","release/0.1.47","release/0.1.46","release/0.1.45","release/0.1.44","release/0.1.43","release/0.1.42","release/0.1.41","release/0.1.40","release/0.1.39","release/0.1.38","release/0.1.37","release/0.1.36","release/0.1.35","release/0.1.34","release/0.1.33","release/0.1.32","release/0.1.31","release/0.1.30","release/0.1.29","release/0.1.28","release/0.1.27","release/0.1.26","release/0.1.25","release/0.1.24","release/0.1.23","release/0.1.22","release/0.1.21","release/0.1.20","release/0.1.19","release/0.1.18","release/0.1.17","release/0.1.16","release/0.1.15","release/0.1.14","release/0.1.13","release/0.1.12","release/0.1.11","release/0.1.10","release/0.1.9","release/0.1.8","release/0.1.7","release/0.1.6","release/0.1.5","release/0.1.4","release/0.1.3","release/0.1.2","release/0.1.1","release/0.1.0","release/0.0.14","release/0.0.13","release/0.0.12","release/0.0.11","release/0.0.10","release/0.0.9","release/0.0.8","release/0.0.7","release/0.0.6","release/0.0.5","release/0.0.4","release/0.0.3","release/0.0.2","release/0.0.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-68502.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}