CVE-2026-112159 in JumpServer
Summary
by MITRE • 10/19/2026
A security vulnerability has been detected in JumpServer up to 4.10.19. The affected element is an unknown function of the component Template Rendering. The manipulation of the argument IP/HOST leads to os command injection. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. Upgrading to version 5.0.0 is sufficient to fix this issue. The identifier of the patch is fcf2904cdb884230e9676f50f37a44d09fa97040. The affected component should be upgraded. The vendor confirms: "This issue was identified quite some time ago, and we have already fixed it in the v5 branch. (...) The fix will also be included in an upcoming v4 release.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/19/2026
JumpServer versions up to 4.10.19 contain a critical security vulnerability within its Template Rendering component that allows for remote operating system command injection. This flaw arises from improper validation and sanitization of user-supplied input, specifically targeting the IP or HOST argument passed during template processing operations. The underlying technical issue stems from the direct concatenation of unsanitized external data into shell commands without adequate escaping mechanisms. When an attacker provides a maliciously crafted string containing shell metacharacters such as semicolons, pipes, or backticks within the host parameter, the application interprets these characters as executable instructions rather than literal text values. This behavior is characteristic of CWE-78 Improper Neutralization of Special Elements used in an OS Command, commonly known as OS Command Injection. The vulnerability exists because the software fails to distinguish between data and code during the execution phase, allowing arbitrary commands to be executed with the privileges of the application process.
The operational impact of this vulnerability is severe due to its remote exploitability. An unauthenticated attacker can leverage this flaw over a network connection to execute arbitrary system commands on the underlying host operating system. Since JumpServer typically runs as a privileged service managing infrastructure access, successful exploitation could lead to complete compromise of the server hosting the application. Attackers may use this entry point to install backdoors, exfiltrate sensitive data stored within the platform such as credentials and session tokens, pivot into internal networks managed by JumpServer, or disrupt availability through destructive commands. The fact that public exploits have been disclosed significantly increases the risk landscape, enabling less sophisticated threat actors to conduct automated attacks against vulnerable instances. This aligns with ATT&CK technique T1059 Command and Scripting Interpreter, where adversaries use system utilities like sh or cmd to execute malicious payloads remotely.
Mitigation strategies must prioritize immediate remediation given the availability of public exploits. The vendor has confirmed that this issue was identified previously and resolved in version 5.0.0 through patch identifier fcf2904cdb884230e9676f50f37a44d09fa97040, which implements strict input validation and parameterized command execution to prevent injection attacks. Organizations running JumpServer versions up to 4.10.19 should upgrade immediately to version 5.0.0 or later as recommended by the vendor. For environments where an immediate upgrade is not feasible due to compatibility constraints, a temporary workaround involves restricting network access to the JumpServer management interface using firewalls or reverse proxy configurations that limit exposure to trusted IP ranges only. Additionally, implementing Web Application Firewall rules can help detect and block common command injection patterns in HTTP requests targeting template rendering endpoints until the software update is applied. Regular security audits and penetration testing should be conducted post-upgrade to verify that input sanitization controls are functioning correctly across all affected components.