UNKNOWN NVD
CVE-2026-38595
An issue in im3x Scriptables through v2-dev branch allows attackers to inject arbitrary OS commands via uploading a file with a crafted filename to the /sync en
An issue in im3x Scriptables through v2-dev branch allows attackers to inject arbitrary OS commands via uploading a file with a crafted filename to the /sync endpoint.
References
- https://github.com/Den-Sec/security-research/blob/master/advisories/gohttpserver/VDR-001-z
- https://github.com/Den-Sec/security-research/blob/master/advisories/im3x-scriptables/VDR-0
- https://github.com/im3x/Scriptables
- https://github.com/im3x/Scriptables/blob/v2-dev/app.js
This unknown severity vulnerability was published on 2026-11-03 via NVD.
vulnfeed aggregates 18261 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.