{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-94434", "assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21", "state": "PUBLISHED", "assignerShortName": "TR-CERT", "dateReserved": "2026-09-21T16:19:11.619Z", "datePublished": "2026-11-09T12:13:34.141Z", "dateUpdated": "2026-11-09T15:23:53.113Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21", "shortName": "TR-CERT", "dateUpdated": "2026-11-09T12:13:34.141Z"}, "title": "OS Command Injection Leading to Root Code Execution in T\u00dcB\u0130TAK B\u0130LGEM's Pardus Boot Repair", "datePublic": "2026-11-09T12:11:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-78", "description": "CWE-78 Improper neutralization of special elements used in an OS command ('OS command injection')", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-88", "descriptions": [{"lang": "en", "value": "CAPEC-88 OS Command Injection"}]}], "affected": [{"vendor": "T\u00dcB\u0130TAK B\u0130LGEM Software Technologies Research Institute", "product": "Pardus Boot Repair", "versions": [{"status": "affected", "version": "1.0.8", "lessThan": "1.0.9", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in T\u00dcB\u0130TAK B\u0130LGEM Software Technologies Research Institute Pardus Boot Repair allows OS Command Injection.\n\nThis issue affects Pardus Boot Repair: from 1.0.8 before 1.0.9.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in T\u00dcB\u0130TAK B\u0130LGEM Software Technologies Research Institute Pardus Boot Repair allows OS Command Injection.<p>This issue affects Pardus Boot Repair: from 1.0.8 before 1.0.9.</p>"}]}], "references": [{"url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1486", "tags": ["government-resource"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseSeverity": "HIGH", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}}], "credits": [{"lang": "en", "value": "\u00d6zcan Ersan", "type": "finder"}, {"lang": "en", "value": "Serdar \u00c7ATAL", "type": "finder"}], "source": {"defect": ["TR-26-1486"], "advisory": "TR-26-1486", "discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.5"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-09T15:05:11.230726Z", "id": "CVE-2026-94434", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-09T15:23:53.113Z"}}]}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Pardus Boot Repair", "vendor": "T\u00dcB\u0130TAK B\u0130LGEM Software Technologies Research Institute", "versions": [{"lessThan": "1.0.9", "status": "affected", "version": "1.0.8", "versionType": "semver"}]}], "source": "iletisim@usom.gov.tr"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in T\u00dcB\u0130TAK B\u0130LGEM Software Technologies Research Institute Pardus Boot Repair allows OS Command Injection.\n\nThis issue affects Pardus Boot Repair: from 1.0.8 before 1.0.9."}], "id": "CVE-2026-94434", "lastModified": "2026-11-09T16:17:35.360", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "iletisim@usom.gov.tr", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-94434", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-11-09T15:05:11.230726Z", "version": "2.0.3"}}]}, "published": "2026-11-09T13:17:09.273", "references": [{"source": "iletisim@usom.gov.tr", "url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1486"}], "sourceIdentifier": "iletisim@usom.gov.tr", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-78"}], "source": "iletisim@usom.gov.tr", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.0.8,1.0.9)"}}], "enrichment": {"confidence": 97.0, "confidence_source": "matching", "scores": [{"score": 97.0, "source": "matching"}]}, "original": {"product": "Pardus Boot Repair", "source": "cna", "vendor": "T\u00dcB\u0130TAK B\u0130LGEM Software Technologies Research Institute"}, "product": "pardus_boot_repair", "vendor": "tubitak_bilgem_software_technologies_research_institute"}], "created": "2026-11-09T13:30:11.132945+00:00", "updated": "2026-11-09T16:30:12.041266+00:00", "vendors": ["tubitak_bilgem_software_technologies_research_institute", "tubitak_bilgem_software_technologies_research_institute$PRODUCT$pardus_boot_repair"]}