CVE-2026-8663

MEDIUM

OS Command Injection in Rapid7 InsightConnect RPM Plugin

Title source: cna
STIX 2.1

Description

OS Command Injection vulnerability in Rapid7 InsightConnect RPM Plugin on Linux allows authenticated attackers to execute arbitrary OS commands via the repo, key, or name parameters due to insufficient input sanitization in shell command construction.

References (1)

Core 1
Core References
Vendor Advisory vendor-advisory
https://extensions.rapid7.com/extension/rpm

Scores

CVSS v3 6.0
EPSS 0.0083
EPSS Percentile 54.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:L

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-78
Status published
Products (3)
Rapid7/InsightConnect RPM Plugin < 1.0.2
Rapid7/InsightConnect RPM Plugin 1.0.2
rapid7/insightconnect_rpm < 1.0.2
Published Jun 25, 2026
Tracked Since Jun 25, 2026