CVE-2026-91837

Name of the Vulnerable Software and Affected Versions NetworkManager-iodine (affected versions not specified)

Description A flaw exists in the iodine VPN plugin for NetworkManager. A local unprivileged user can achieve local privilege escalation by exploiting the way the nameserver setting is processed during the establishment of an iodine VPN connection. By embedding shell metacharacters—special characters that allow the execution of commands—within the nameserver value, an attacker can inject and execute arbitrary commands with root privileges before the application drops its elevated permissions.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.