CVE-2026-68489

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-68489", "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "state": "PUBLISHED", "assignerShortName": "hackerone", "dateReserved": "2026-07-30T15:00:00.609Z", "datePublished": "2026-09-14T20:53:05.644Z", "dateUpdated": "2026-09-15T13:28:53.581Z"}, "containers": {"cna": {"descriptions": [{"lang": "en", "value": "Static Code Injection in Plesk extensions \"Ruby\" before 1.6.6 and \"Node.js Toolkit\" before 2.5.0 allows remote authenticated users to execute arbitrary code as root via custom environment variables."}], "affected": [{"defaultStatus": "unaffected", "vendor": "WebPros", "product": "Plesk extension \"Ruby\"", "versions": [{"version": "0", "status": "affected", "lessThan": "1.6.6", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "vendor": "WebPros", "product": "Plesk extension \"Node.js Toolkit\"", "versions": [{"version": "0", "status": "affected", "lessThan": "2.5.0", "versionType": "semver"}]}], "references": [{"url": "https://support.plesk.com/hc/en-us/articles/43473204617239"}], "metrics": [{"cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "baseScore": 8.7, "baseSeverity": "HIGH"}}], "problemTypes": [{"descriptions": [{"type": "CWE", "lang": "en", "cweId": "CWE-96", "description": "CWE-96 Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')"}]}], "credits": [{"lang": "en", "value": "d1n4h", "type": "finder"}], "providerMetadata": {"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "shortName": "hackerone", "dateUpdated": "2026-09-14T20:53:05.644Z"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-15T13:28:42.978491Z", "id": "CVE-2026-68489", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-15T13:28:53.581Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-68489", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-09-15T13:28:42.978491Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-15T13:28:50.369Z"}}], "cna": {"credits": [{"lang": "en", "type": "finder", "value": "d1n4h"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 8.7, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}}], "affected": [{"vendor": "WebPros", "product": "Plesk extension \"Ruby\"", "versions": [{"status": "affected", "version": "0", "lessThan": "1.6.6", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "WebPros", "product": "Plesk extension \"Node.js Toolkit\"", "versions": [{"status": "affected", "version": "0", "lessThan": "2.5.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://support.plesk.com/hc/en-us/articles/43473204617239"}], "descriptions": [{"lang": "en", "value": "Static Code Injection in Plesk extensions \"Ruby\" before 1.6.6 and \"Node.js Toolkit\" before 2.5.0 allows remote authenticated users to execute arbitrary code as root via custom environment variables."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-96", "description": "CWE-96 Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')"}]}], "providerMetadata": {"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "shortName": "hackerone", "dateUpdated": "2026-09-14T20:53:05.644Z"}}}, "cveMetadata": {"cveId": "CVE-2026-68489", "state": "PUBLISHED", "dateUpdated": "2026-09-15T13:28:53.581Z", "dateReserved": "2026-07-30T15:00:00.609Z", "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "datePublished": "2026-09-14T20:53:05.644Z", "assignerShortName": "hackerone"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Plesk extension \"Ruby\"", "vendor": "WebPros", "versions": [{"lessThan": "1.6.6", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Plesk extension \"Node.js Toolkit\"", "vendor": "WebPros", "versions": [{"lessThan": "2.5.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "support@hackerone.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Static Code Injection in Plesk extensions \"Ruby\" before 1.6.6 and \"Node.js Toolkit\" before 2.5.0 allows remote authenticated users to execute arbitrary code as root via custom environment variables."}], "id": "CVE-2026-68489", "lastModified": "2026-09-18T19:34:36.657", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "support@hackerone.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-68489", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-09-15T13:28:42.978491Z", "version": "2.0.3"}}]}, "published": "2026-09-14T21:17:25.567", "references": [{"source": "support@hackerone.com", "url": "https://support.plesk.com/hc/en-us/articles/43473204617239"}], "sourceIdentifier": "support@hackerone.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-96"}], "source": "support@hackerone.com", "type": "Secondary"}]}

{"bugzilla": {"description": "Ruby: Node.js Toolkit: Plesk Extensions Ruby and Node.js Toolkit: Arbitrary Code Execution via Static Code Injection", "id": "2533442", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533442"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.8", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-94", "details": ["A flaw was found in Plesk extensions Ruby and Node.js Toolkit. This static code injection vulnerability allows remote authenticated users to execute arbitrary code as root. The flaw is triggered by manipulating custom environment variables, leading to a complete compromise of the affected system."], "name": "CVE-2026-68489", "package_state": [{"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift_devspaces:3", "fix_state": "Affected", "package_name": "devspaces/code-rhel9", "product_name": "Red Hat OpenShift Dev Spaces"}], "public_date": "2026-09-14T20:53:05Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-68489\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-68489\nhttps://support.plesk.com/hc/en-us/articles/43473204617239"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,2.5.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Plesk extension \"Node.js Toolkit\"", "source": "cna", "vendor": "WebPros"}, "product": "plesk_extension_\"node.js_toolkit\"", "vendor": "webpros"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,1.6.6)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Plesk extension \"Ruby\"", "source": "cna", "vendor": "WebPros"}, "product": "plesk_extension_\"ruby\"", "vendor": "webpros"}], "created": "2026-09-15T10:15:17.105032+00:00", "updated": "2026-09-17T22:00:16.593956+00:00", "vendors": ["webpros", "webpros$PRODUCT$plesk_extension_\"node.js_toolkit\"", "webpros$PRODUCT$plesk_extension_\"ruby\""]}