CVE-2026-107202

Name of the Vulnerable Software and Affected Versions h-ui versions prior to v0.0.26

Description A command injection issue exists in the administrative API due to improper validation of the listen configuration field. When an authenticated administrator provides a value containing shell metacharacters, the application uses fmt.Sprintf to construct nftables or iptables rule strings and executes them via bash -c with root privileges. The lack of port or format validation in the listen field allows for the injection and execution of arbitrary operating system commands as root.

Recommendations Update h-ui to a version later than v0.0.25. As a temporary mitigation, restrict access to the administrative API and avoid entering shell metacharacters in the listen configuration field.