CVE-2026-25933

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-25933", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-09T16:22:17.786Z", "datePublished": "2026-02-12T19:57:17.704Z", "dateUpdated": "2026-02-12T20:58:56.862Z"}, "containers": {"cna": {"title": "Arduino App Lab has Improper Data Validation in Internal Terminal Interface", "problemTypes": [{"descriptions": [{"cweId": "CWE-78", "lang": "en", "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "PHYSICAL", "availabilityImpact": "HIGH", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:P/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/arduino/arduino-app-lab/security/advisories/GHSA-3652-939f-f7g4", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/arduino/arduino-app-lab/security/advisories/GHSA-3652-939f-f7g4"}, {"name": "https://github.com/arduino/arduino-app-lab/releases/tag/al-0.4.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/arduino/arduino-app-lab/releases/tag/al-0.4.0"}], "affected": [{"vendor": "arduino", "product": "arduino-app-lab", "versions": [{"version": "< 0.4.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-12T19:57:17.704Z"}, "descriptions": [{"lang": "en", "value": "Arduino App Lab is a cross-platform IDE for developing Arduino Apps. Prior to 0.4.0, a vulnerability was identified in the Terminal component of the arduino-app-lab application. The issue stems from insufficient sanitization and validation of input data received from connected hardware devices, specifically in the _info.Serial and _info.Address metadata fields. The problem occurs during device information handling. When a board is connected, the application collects identifying attributes to establish a terminal session. Because strict validation is not enforced for the Serial and Address parameters, an attacker with control over the connected hardware can supply specially crafted strings containing shell metacharacters. The exploitation requires direct physical access to a previously tampered board. When the host system processes these fields, any injected payload is executed with the privileges of the user running arduino-app-lab. This vulnerability is fixed in 0.4.0."}], "source": {"advisory": "GHSA-3652-939f-f7g4", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-12T20:58:36.079406Z", "id": "CVE-2026-25933", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-12T20:58:56.862Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-25933", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-12T20:58:36.079406Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-12T20:58:46.304Z"}}], "cna": {"title": "Arduino App Lab has Improper Data Validation in Internal Terminal Interface", "source": {"advisory": "GHSA-3652-939f-f7g4", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.9, "attackVector": "PHYSICAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:P/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "arduino", "product": "arduino-app-lab", "versions": [{"status": "affected", "version": "< 0.4.0"}]}], "references": [{"url": "https://github.com/arduino/arduino-app-lab/security/advisories/GHSA-3652-939f-f7g4", "name": "https://github.com/arduino/arduino-app-lab/security/advisories/GHSA-3652-939f-f7g4", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/arduino/arduino-app-lab/releases/tag/al-0.4.0", "name": "https://github.com/arduino/arduino-app-lab/releases/tag/al-0.4.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Arduino App Lab is a cross-platform IDE for developing Arduino Apps. Prior to 0.4.0, a vulnerability was identified in the Terminal component of the arduino-app-lab application. The issue stems from insufficient sanitization and validation of input data received from connected hardware devices, specifically in the _info.Serial and _info.Address metadata fields. The problem occurs during device information handling. When a board is connected, the application collects identifying attributes to establish a terminal session. Because strict validation is not enforced for the Serial and Address parameters, an attacker with control over the connected hardware can supply specially crafted strings containing shell metacharacters. The exploitation requires direct physical access to a previously tampered board. When the host system processes these fields, any injected payload is executed with the privileges of the user running arduino-app-lab. This vulnerability is fixed in 0.4.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-78", "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-12T19:57:17.704Z"}}}, "cveMetadata": {"cveId": "CVE-2026-25933", "state": "PUBLISHED", "dateUpdated": "2026-02-12T20:58:56.862Z", "dateReserved": "2026-02-09T16:22:17.786Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-12T19:57:17.704Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "arduino-app-lab", "vendor": "arduino", "versions": [{"status": "affected", "version": "< 0.4.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:arduino:app_lab:*:*:*:*:*:*:*:*", "matchCriteriaId": "244EB8A1-C8D1-40CA-A05C-ADA31BBD1252", "versionEndExcluding": "0.4.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Arduino App Lab is a cross-platform IDE for developing Arduino Apps. Prior to 0.4.0, a vulnerability was identified in the Terminal component of the arduino-app-lab application. The issue stems from insufficient sanitization and validation of input data received from connected hardware devices, specifically in the _info.Serial and _info.Address metadata fields. The problem occurs during device information handling. When a board is connected, the application collects identifying attributes to establish a terminal session. Because strict validation is not enforced for the Serial and Address parameters, an attacker with control over the connected hardware can supply specially crafted strings containing shell metacharacters. The exploitation requires direct physical access to a previously tampered board. When the host system processes these fields, any injected payload is executed with the privileges of the user running arduino-app-lab. This vulnerability is fixed in 0.4.0."}, {"lang": "es", "value": "Arduino App Lab es un IDE multiplataforma para desarrollar aplicaciones de Arduino. Antes de la versi\u00f3n 0.4.0, se identific\u00f3 una vulnerabilidad en el componente Terminal de la aplicaci\u00f3n arduino-app-lab. El problema se origina por la sanitizaci\u00f3n y validaci\u00f3n insuficientes de los datos de entrada recibidos de los dispositivos de hardware conectados, espec\u00edficamente en los campos de metadatos _info.Serial y _info.Address. El problema ocurre durante el manejo de la informaci\u00f3n del dispositivo. Cuando se conecta una placa, la aplicaci\u00f3n recopila atributos de identificaci\u00f3n para establecer una sesi\u00f3n de terminal. Debido a que no se aplica una validaci\u00f3n estricta para los par\u00e1metros Serial y Address, un atacante con control sobre el hardware conectado puede proporcionar cadenas especialmente dise\u00f1adas que contengan metacaracteres de shell. La explotaci\u00f3n requiere acceso f\u00edsico directo a una placa previamente manipulada. Cuando el sistema anfitri\u00f3n procesa estos campos, cualquier carga \u00fatil inyectada se ejecuta con los privilegios del usuario que ejecuta arduino-app-lab. Esta vulnerabilidad se corrigi\u00f3 en la versi\u00f3n 0.4.0."}], "id": "CVE-2026-25933", "lastModified": "2026-06-17T10:25:27.133", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "PHYSICAL", "availabilityImpact": "HIGH", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:P/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 0.2, "impactScore": 6.0, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-25933", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-02-12T20:58:36.079406Z", "version": "2.0.3"}}]}, "published": "2026-02-12T20:16:11.067", "references": [{"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/arduino/arduino-app-lab/releases/tag/al-0.4.0"}, {"source": "security-advisories@github.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://github.com/arduino/arduino-app-lab/security/advisories/GHSA-3652-939f-f7g4"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-78"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.4.0)"}}], "product": "arduino-app-lab", "vendor": "arduino"}], "analysis": {"en": {"generated_at": "2026-04-17T19:59:53.855964+00:00", "value": {"mitigation_remediation": ["Update Arduino App Lab to version 0.4.0 or later where the command injection issue is resolved.", "If an upgrade is not immediately possible, disable the Terminal component or prevent the application from processing metadata from untrusted hardware devices by restricting physical access to the board.", "Apply custom input validation or patch the source code to escape or reject shell metacharacters in the _info.Serial and _info.Address fields before they are executed by the host system."], "summary": {"action": "Apply patch", "impact": "Command execution"}, "threat_synthesis": {"affected_systems": "The affected product is Arduino App Lab for all versions prior to 0.4.0. Vendors and versions are identified as arduino:arduino-app-lab with any subvariant. The vulnerability was fixed in release 0.4.0, so installations of that version or later are not impacted.", "description_and_impact": "The vulnerability in Arduino App Lab arises from insufficient validation of input data received from connected hardware, specifically the _info.Serial and _info.Address metadata fields used during device information handling. Because these fields do not enforce strict sanitization, an attacker who controls the connected board can supply specially crafted strings that include shell metacharacters. When the host system processes these values, the injected payload is executed with the privileges of the user running Arduino App Lab, exposing the host operating system to command execution that effectively bypasses normal application constraints.", "risk_and_exploitability": "The CVSS Base Score of 6.9 indicates moderate severity, and the EPSS score of less than 1% reflects a very low probability of exploitation in the wild. The vulnerability is not included in the CISA KEV catalog. Exploitation requires direct physical access to a compromised or tampered board and then connecting it to a host running the vulnerable version of Arduino App Lab. Once the connection is established, the host processes the injected shell metacharacters, which results in elevated command execution under the current user context. Given the moderate CVSS score, low EPSS, and requirement for physical access, the overall risk to systems is moderate, but any compromised board could lead to local code execution on the host machine."}}}}, "created": "2026-02-13T21:29:28.207182+00:00", "updated": "2026-04-17T20:00:09.043633+00:00", "vendors": ["arduino", "arduino$PRODUCT$arduino-app-lab"]}