CVE-2026-5012 MEDIUM

CVE-2026-5012: elecV2 elecV2P rpc pm2run os command injection

Vendor Elecv2
Product elecV2P
Weakness CWE-78
Published March 28, 2026
Last update March 30, 2026
View on NVD All CVEs

CVSS base score

6.9/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

What the vulnerability does

01Description

A flaw has been found in elecV2 elecV2P up to 3.8.3. This issue affects the function pm2run of the file /rpc. Executing a manipulation can lead to os command injection. The attack can be executed remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Key dates

02Disclosure timeline

March 28, 2026 CVE published
March 30, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-35521 Pi-hole FTL affected by Remote Code Execution (RCE) via dhcp.hosts Newline Injection CVE-2026-7136 Totolink A8000RU CGI cstecgi.cgi setDmzCfg os command injection CVE-2024-6048 Openfind MailGates and MailAudit - OS Command Injection CVE-2024-41956 Soft Serve allows arbitrary code execution by crafting git-lfs requests CVE-2026-23920 Host and event action script regex validation can be bypassed in certain situations, leading to potential command injection