OS Command Injection in Sakura Editor by Sakura Editor Development Community
CVE-2026-59561

8.4HIGH

Key Information:

Vendor

Sakura Editor Development Community

Status
Sakura Editor
Vendor
CVE Published:
24 August 2026

What is CVE-2026-59561?

Sakura Editor, developed by the Sakura Editor Development Community, contains a vulnerability that enables OS command injection. When users are directed to edit a file within a specially crafted directory, there's a risk of arbitrary OS command execution on the user's computer upon invoking the 'Open Terminal' feature. This vulnerability underscores the critical importance of secure coding practices and user awareness in mitigating the risks associated with arbitrary command execution threats.

Affected Version(s)

Sakura Editor 0 < 2.4.3

References

https://github.com/sakura-editor/sakura/security/advisori...
https://github.com/sakura-editor/sakura/releases/tag/v2.4.3
https://jvn.jp/en/jp/JVN74538868/

CVSS V4

Score:
8.4
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

CVSS V3.0

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.