CVE-2026-7642

MediumCVSS 6.3/10Last modified Jun 17, 2026

Description

A vulnerability was detected in pskill9 website-downloader up to 0.1.0. This affects the function download_website of the file src/index.ts of the component MCP Interface. Performing a manipulation of the argument outputPath results in os command injection. The attack may be initiated remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-77CWE-78

Affected software

No affected versions have been published.

Timeline

Published
May 2, 2026
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-764209.0A vulnerability in the internal configuration of the Apache JServ Protocol (AJP) connector for Cisco Secure FMC Software could allow anCVE-2026-7642310.0A vulnerability in the REST API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to gain administrative accessCVE-2026-764247.2A vulnerability in the REST API of Cisco ISE could allow an authenticated, remote attacker to upload or copy arbitrary files on an affected CVE-2026-764257.6A vulnerability in the APIs of Cisco ISE could allow an authenticated, remote attacker to conduct SQL injection attacks against the backend CVE-2026-764264.9A vulnerability in the REST API of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to conduct SQL injection attackCVE-2026-764274.9A vulnerability in the offline profiler feed service of Cisco ISE could allow an authenticated, remote attacker to read arbitrary files thatCVE-2026-764284.9A vulnerability in the REST APIs of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to conduct SQL injection attacCVE-2026-76434.3A flaw has been found in ChatGPTNextWeb NextChat up to 2.16.1. This impacts an unknown function of the file Next.js of the component API EndCVE-2026-764314.9A vulnerability in the file management function of the web-based management interface of Cisco ISE and Cisco ISE-PIC could allow an authentiCVE-2026-764324.9A vulnerability in the web-based management interface of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker with admiCVE-2026-764335.3A vulnerability in the client provisioning download feature of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker tCVE-2026-764344.9A vulnerability in the certificate import functionality of the web-based management interface of Cisco ISE and Cisco ISE-PIC could allow an
CVE-2026-7642: Medium severity, CVSS 6.3 | Vulnix