{"affected":[{"product":"n/a","source":"CNA: mitre","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"cveId":"CVE-2026-38595","cwes":[],"description":"An issue in im3x Scriptables through v2-dev branch allows attackers to inject arbitrary OS commands via uploading a file with a crafted filename to the /sync endpoint.","epss":null,"exploits":[],"kev":null,"metrics":[],"modifiedAt":1793726292917,"publishedAt":1793664000000,"references":[{"source":"CNA: mitre","tags":[],"url":"https://github.com/im3x/Scriptables"},{"source":"CNA: mitre","tags":[],"url":"https://github.com/im3x/Scriptables/blob/v2-dev/app.js"},{"source":"CNA: mitre","tags":[],"url":"https://github.com/Den-Sec/security-research/blob/master/advisories/gohttpserver/VDR-001-zipslip.md"},{"source":"CNA: mitre","tags":[],"url":"https://github.com/Den-Sec/security-research/blob/master/advisories/im3x-scriptables/VDR-003-os-command-injection.md"},{"source":"cve@mitre.org","tags":[],"url":"https://github.com/Den-Sec/security-research/blob/master/advisories/gohttpserver/VDR-001-zipslip.md"},{"source":"cve@mitre.org","tags":[],"url":"https://github.com/Den-Sec/security-research/blob/master/advisories/im3x-scriptables/VDR-003-os-command-injection.md"},{"source":"cve@mitre.org","tags":[],"url":"https://github.com/im3x/Scriptables"},{"source":"cve@mitre.org","tags":[],"url":"https://github.com/im3x/Scriptables/blob/v2-dev/app.js"}],"remediation":[],"revision":"b1a0bc722c6cad00e60f1d7d53c454985cebdff6f6737da312fed7fc52f20f6e","sources":[{"modifiedAt":1793725012871,"name":"CNA: mitre","retrievedAt":1793725942968,"url":"https://www.cve.org/CVERecord?id=CVE-2026-38595"},{"modifiedAt":1793726292917,"name":"NVD","retrievedAt":1793730114895,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-38595"}],"ssvc":null,"status":"published","title":"CVE-2026-38595","updatedAt":1793730114895}