OS Command Injection in Rapid7 InsightConnect Sed Plugin for Linux
CVE-2026-9155

8.8HIGH

Key Information:

Vendor

Rapid7

Status
Insightconnect Sed Plugin
Vendor
CVE Published:
25 June 2026

What is CVE-2026-9155?

An OS Command Injection vulnerability exists in the Rapid7 InsightConnect Sed Plugin for Linux that allows authenticated attackers to execute arbitrary operating system commands. This vulnerability is exploited via the expression parameter due to insufficient input validation. Attackers leveraging this flaw could potentially compromise the integrity and confidentiality of systems utilizing the affected plugin.

Affected Version(s)

InsightConnect Sed Plugin Linux 0 < 2.0.5

InsightConnect Sed Plugin Linux 2.0.5

References

https://extensions.rapid7.com/extension/sed
vendor-advisory

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Jacob Steadman, Rapid7
Jed Starr, Rapid7
Sebastián Alba Vives (@Sebasteuo / 0xs4bbi), Independent security researcher, Costa Rica
.