OS Command Injection Vulnerability in QUSETIONS MiniCode-Python
CVE-2026-16488

2.3LOW

Key Information:

Vendor

Qusetions

Status
Minicode-python
Vendor
CVE Published:
21 July 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-16488?

A security flaw was identified in QUSETIONS MiniCode-Python version 0.1.0, specifically impacting the subprocess.Popen function within the Project File Handler component. This vulnerability allows for potential OS command injection, creating a pathway for attackers to execute arbitrary commands on the server. Due to its nature, an attack exploiting this vulnerability can be conducted remotely although the complexity associated with successful exploitation is relatively high. The vulnerability has been publicly disclosed, meaning it is critical for users to take preventative actions. To mitigate this issue, it is strongly recommended to upgrade to version 0.1.0-rc1 where the issue is resolved through a patch (commit 9d868dc2550f426c6ddf8ee98f30ffe450ca5e32).

Affected Version(s)

MiniCode-Python 0.1.0

MiniCode-Python 0.1.0-rc1

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-16488 - Proof of Concept

References

https://vuldb.com/vuln/380945
vdb-entrytechnical-description
https://vuldb.com/vuln/380945/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-16488
third-party-advisory

CVSS V4

Score:
2.3
Severity:
LOW
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

JasperX (VulDB User)
.