CVE-2024-28886

HIGH

UTAU < 0.4.19 - OS Command Injection via Crafted UST File

Title source: llm

Description

OS command injection vulnerability exists in UTAU versions prior to v0.4.19. If a user of the product opens a crafted UTAU project file (.ust file), an arbitrary OS command may be executed.

References (2)

Core 2

Core References

Various Sources

https://utau2008.xrea.jp/

Third Party Advisory

https://jvn.jp/en/jp/JVN71404925/

Scores

CVSS v3 8.4

EPSS 0.0066

EPSS Percentile 47.1%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-94

Status published

Products (1)

ameya/ayame/UTAU prior to v0.4.19

Published May 28, 2024

Tracked Since Feb 18, 2026