CVE-2026-5208 HIGH

CVE-2026-5208: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in coolercontrold

Vendor Coolercontrol

Product coolercontrold

Weakness CWE-78

Published April 8, 2026

Last update April 8, 2026

View on NVD All CVEs

CVSS base score

8.2/10

Attack vector Local

Attack complexity Low

Privileges required High

User interaction None

Confidentiality High

Integrity High

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

What the vulnerability does

01Description

Command injection in alerts in CoolerControl/coolercontrold <4.0.0 allows authenticated attackers to execute arbitrary code as root via injected bash commands in alert names

Key dates

02Disclosure timeline

April 8, 2026 CVE published

April 8, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-5208 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/78.html

Related vulnerabilities

CVE-2026-5208: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in coolercontrold

01Description

02Disclosure timeline

03References

04Related CVE