# CVE-2026-120275: Shanghai Xi Yu Ji Zhi Technology Minimax Code Find os command injection

Status: published. Published: 2026-11-01. Updated: 2026-11-01.

A security flaw has been discovered in Shanghai Xi Yu Ji Zhi Technology Minimax Code 0.5.8. This affects an unknown part of the component Find Command Handler. The manipulation of the argument -exec results in os command injection. The attack may be performed from remote. The vendor was contacted early about this disclosure but did not respond in any way.

## Remediation

No remediation reported in collected sources

## Affected products and versions

- Shanghai Xi Yu Ji Zhi Technology / Minimax Code: 0.5.8 (affected). Source: CNA: VulDB

## Severity and prioritization

- CVSS 4.0: 5.1 (medium); CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X; source: CNA: VulDB

- CVSS 3.1: 5.5 (medium); CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L/E:X/RL:X/RC:C; source: CNA: VulDB

- CVSS 3.0: 5.5 (medium); CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L/E:X/RL:X/RC:C; source: CNA: VulDB

- CVSS 2.0: 6.5 (medium); AV:N/AC:L/Au:S/C:P/I:P/A:P/E:ND/RL:ND/RC:C; source: CNA: VulDB

- CVSS 4.0: 5.1 (medium); CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X; source: NVD: cna@vuldb.com

- CVSS 3.1: 5.5 (medium); CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L; source: NVD: cna@vuldb.com

- CVSS 2.0: 6.5 (medium); AV:N/AC:L/Au:S/C:P/I:P/A:P; source: NVD: cna@vuldb.com

- CISA KEV: No listing in collected sources

- EPSS: Not available

- SSVC: Not available

- Weaknesses: CWE-78, CWE-77

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://vuldb.com/vuln/429619 (CNA: VulDB; vdb-entry, technical-description)

- https://vuldb.com/vuln/429619/cti (CNA: VulDB; signature, permissions-required)

- https://vuldb.com/cve/CVE-2026-120275 (CNA: VulDB; third-party-advisory)

- https://vuldb.com/submit/1007426 (CNA: VulDB; third-party-advisory)

- https://mcniyfj5bw9b.feishu.cn/docx/RenxdtY52oBlqRxN4S7csZtNnUc (CNA: VulDB; related)

- https://mcniyfj5bw9b.feishu.cn/docx/RenxdtY52oBlqRxN4S7csZtNnUc (cna@vuldb.com)

- https://vuldb.com/cve/CVE-2026-120275 (cna@vuldb.com)

- https://vuldb.com/submit/1007426 (cna@vuldb.com)

- https://vuldb.com/vuln/429619 (cna@vuldb.com)

- https://vuldb.com/vuln/429619/cti (cna@vuldb.com)

## Provenance

- CNA: VulDB: https://www.cve.org/CVERecord?id=CVE-2026-120275; retrieved 2026-11-02; source updated 2026-11-01

- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-120275; retrieved 2026-11-02; source updated 2026-11-01

Revision: cbda8b6098012c8f91365f8b68ee5635da650f14c802d7b1282635207670e36d

Canonical: https://y2.dev/cve/CVE-2026-120275