HTTP Sandbox Policy Vulnerability in radareorg radare2 Software
CVE-2026-112077

6.3MEDIUM

Key Information:

Vendor

Radareorg

Status
Radare2
Vendor
CVE Published:
19 October 2026

What is CVE-2026-112077?

A vulnerability in the HTTP Sandbox Policy of radareorg radare2 versions 6.2.0 and 6.2.2 allows for potential remote exploitation through malicious command executions. The core issue lies within the function r_core_cmd_str_pipe in the library libr/core/rtr_http.inc.c, where the sandbox configuration is mismanaged. Although the HTTP server's default setting of http.sandbox=true aims to provide protection, it fails to adequately restrict command capabilities due to its default configuration allowing all sandbox abilities, including process execution. This situation heightens the risk when the HTTP command endpoint is exposed to untrusted users. Users are advised to upgrade to version 6.2.4 to mitigate risks associated with this vulnerability.

Affected Version(s)

radare2 6.2.0

radare2 6.2.2

radare2 6.2.4

References

https://vuldb.com/vuln/421756
vdb-entrytechnical-description
https://vuldb.com/vuln/421756/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-112077
third-party-advisory

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

lijunjie (VulDB User)
VulDB CNA Team
.