CVE-2026-25828

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

grub-btrfs through 2026-01-31 (on Arch Linux and derivative distributions) allows initramfs OS command injection because it does not sanitize the $root parameter to resolve_device(). NOTE: a third party reports "exploitation may not be feasible under normal conditions and may depend on specific implementation details within resolve_device."

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published: Feb 12, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-25836.4The Blocksy theme for WordPress is vulnerable to Stored Cross-Site Scripting via the `blocksy_meta` metadata fields in all versions up to, a CVE-2026-258323.7In Mbed TLS 3.6.x before 3.6.7 and 4.1.x before 4.1.2, the TLS 1.3 client accepts HelloRetryRequest selecting an unadvertised group.CVE-2026-258337.5Mbed TLS 3.5.0 to 3.6.5 fixed in 3.6.6 and 4.1.0 has a buffer overflow in the x509_inet_pton_ipv6() function CVE-2026-258346.5Mbed TLS v3.3.0 up to 3.6.5 and 4.0.0 allows Algorithm Downgrade.CVE-2026-258357.7Mbed TLS before 3.6.6 and TF-PSA-Crypto before 1.1.0 misuse seeds in a Pseudo-Random Number Generator (PRNG).CVE-2026-258367.2An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox Cloud 5 CVE-2026-25849.3A critical SQL Injection (SQLi) vulnerability has been identified in the authentication module of the system. An unauthenticated, remote att CVE-2026-258466.5In JetBrains YouTrack before 2025.3.119033 access tokens could be exposed in Mailbox logs CVE-2026-258476.1In JetBrains PyCharm before 2025.3.2 a DOM-based XSS on Jupyter viewer page was possible CVE-2026-258489.8In JetBrains Hub before 2025.3.119807 authentication bypass allowing administrative actions was possible CVE-2026-25856.4The Brizy – Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘rootAttributes’ parameter in all version CVE-2026-258505.5in OpenHarmony v6.0 and prior versions allow a local attacker cause information leak