CVE-2026-90770

Name of the Vulnerable Software and Affected Versions Spug versions prior to 3.4.1

Description Authenticated users with monitor permissions can achieve remote code execution on the host system. The issue exists in the ping check() function, which interpolates user-supplied monitor addresses directly into shell commands without proper validation. This allows an attacker to inject shell metacharacters via the '/monitor/run test/' endpoint to execute arbitrary commands with the privileges of the Spug process user.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the '/monitor/run test/' endpoint or limit monitor permissions to trusted users only.