Code Injection Vulnerability in Linketic CityGaussian from Linketic
CVE-2026-108941

2.4LOW

Key Information:

Vendor

Linketic

Status
Citygaussian
Vendor
CVE Published:
12 October 2026

What is CVE-2026-108941?

A code injection vulnerability has been detected in the Linketic CityGaussian software, specifically within the Sidecar Parsing component's parse_cfg_args function located in internal/utils/common.py. This issue allows an attacker to manipulate the cfg_args argument, leading to potential code execution. It's noteworthy that this attack vector is exploitable only from a local environment. Despite an early notification regarding this security concern via an issue report, Linketic has yet to address the vulnerability, leaving users at risk.

Affected Version(s)

CityGaussian 2.0

References

https://vuldb.com/vuln/416766
vdb-entrytechnical-description
https://vuldb.com/vuln/416766/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-108941
third-party-advisory

CVSS V4

Score:
2.4
Severity:
LOW
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

dem0000 (VulDB User)
VulDB CNA Team
.