CVE-2026-41015 - radare2 before 9236f44, when configured on UNIX without SSL, allows command injection via a PDB name to rabin2 -PP

Back Back to CVE browser

HIGH

radare2 before 9236f44, when configured on UNIX without SSL, allows command injection via a PDB name to rabin2 -PP

Published Apr 16, 2026

7.4

HIGH

CVSS 3.1

EPSS 1.04%

Description

radare2 before 9236f44, when configured on UNIX without SSL, allows command injection via a PDB name to rabin2 -PP. NOTE: although users are supposed to use the latest version from git (not a release), the date range for the vulnerable code was less than a week, occurring after 6.1.2 but before 6.1.3.

Affected products

Vendor Radare Product Radare2 Default
unaffected
- Version
  
  Status
  affected
  Constraints

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Radare

Radare2

unaffected

Version	Status	Constraints
	affected

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-78

OS Command Injection

References (5)

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-23161		Advisory
https://github.com/radareorg/radare2/blob/9236f44a28812fe911814e1b3a7bcf1e4de5d3c2/SECURITY.md?plain=1#L3-L5
https://github.com/radareorg/radare2/commit/9236f44a28812fe911814e1b3a7bcf1e4de5d3c2
https://github.com/radareorg/radare2/issues/25650		exploit
https://github.com/radareorg/radare2/pull/25651