CVE-2022-50917
HIGHProtonVPN 1.26.0 - Code Injection
Title source: llmDescription
ProtonVPN 1.26.0 contains an unquoted service path vulnerability in its WireGuard service configuration that allows local attackers to potentially execute arbitrary code. Attackers can exploit the unquoted path by placing malicious executables in specific file system locations to gain elevated privileges during service startup.
Exploits (1)
Scores
CVSS v3
7.8
EPSS
0.0002
EPSS Percentile
5.7%
Attack Vector
LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-428
Status
published
Products (2)
proton/protonvpn
1.26.0
ProtonVPN/ProtonVPN
1.26.0
Published
Jan 13, 2026
Tracked Since
Feb 18, 2026