Description
ngrok v4.3.3 and 5.0.0-beta.2 is vulnerable to Command Injection.
References (2)
Core 2
Scores
CVSS v3
8.8
EPSS
0.0098
EPSS Percentile
57.6%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
total
Details
CWE
CWE-77
Status
published
Products (1)
npm/ngrok
npm
Published
May 18, 2026
Tracked Since
May 18, 2026