Shell Command Injection Vulnerability in tsParticles Library by tsparticles

CVE-2026-76826

What is CVE-2026-76826?

The tsParticles library, utilized for crafting customizable particle animations, is susceptible to a vulnerability whereby user-controlled shell metacharacters can be exploited during a stable release process. Specifically, from versions 4.0.0 to 4.3.2, an insecure interpolation of release note text directly into a Bash command can lead to arbitrary code execution. This flaw can allow malicious contributors to manipulate generated artifacts or scripts that have elevated permissions, affecting subsequent release steps. Addressed in version 4.3.2, users are advised to update to this patched version to mitigate risks.

References