CVE-2026-11408: Vertex-App OS Command Injection RCE Flaw

CVE-2026-11408 Overview

CVE-2026-11408 is an OS command injection vulnerability in vertex-app vertex through version 2026.02.12. The flaw resides in the app/model/LogMod.js file, which implements the Log Viewer Endpoint component. Attacker-controlled values passed through req.query are concatenated into a shell command without sanitization, allowing remote command execution. The issue is tracked under CWE-77 (Improper Neutralization of Special Elements used in a Command). A public exploit is referenced, and the upstream project has shipped a fix in commit 805d82e7100d49b79b3beb1b9420e8e458987198.

Critical Impact
Authenticated remote attackers can inject arbitrary operating system commands through the log viewer endpoint, leading to unauthorized command execution on the host running the vertex application.

Affected Products

vertex-app vertex up to and including version 2026.02.12
Deployments exposing the Log Viewer Endpoint over the network
Installations running unpatched app/model/LogMod.js

Discovery Timeline

2026-06-06 - CVE-2026-11408 published to NVD
2026-06-08 - Last updated in NVD database

Technical Details for CVE-2026-11408

Vulnerability Analysis

The vulnerability exists in the get method of the LogMod class within app/model/LogMod.js. The method builds a tail -n 2000 ${logFile} shell command using string interpolation, where logFile is derived from options.type originating from req.query. The unfiltered query value flows into execSync, allowing shell metacharacters such as ;, &&, |, and backticks to terminate the intended command and execute attacker-supplied commands. Because the endpoint is reachable over the network with low privileges, exploitation requires no local access and no user interaction.

Root Cause

The root cause is the use of child_process.execSync with an unvalidated, attacker-controlled string. No allow-list constrained the type parameter, and no argument escaping or array-form invocation was used. Any value supplied via req.query was trusted as a benign log identifier.

Attack Vector

A remote attacker with access to the application sends a crafted HTTP request to the log viewer endpoint, supplying a type parameter containing shell metacharacters. The injected payload is appended to the tail command and executed by the shell under the privileges of the Node.js process.

javascript

// Source: https://github.com/vertex-app/vertex/commit/805d82e7100d49b79b3beb1b9420e8e458987198
// Patch in app/model/LogMod.js - replaces execSync with a validated spawnSync call
-const { execSync } = require('child_process');
+const { spawnSync } = require('child_process');
 const path = require('path');
 const fs = require('fs');
 const logger = require('../libs/logger');

 class LogMod {
   get (options) {
-    const logFile = path.join(__dirname, `../../logs/app-${options.type}.log`);
-    const log = execSync(`tail -n 2000 ${logFile}`).toString();
-    return log;
+    if (['error', 'info', 'debug', 'watch', 'watchdebug', 'binge', 'bingedebug', 'advanceddebug', 'advanced', 'scdebug', 'sc'].includes(options.type)) {
+      try {
+        const logFile = path.join(__dirname, `../../logs/app-${options.type}.log`);
+        if (!fs.existsSync(logFile)) {
+          return '日志文件尚不存在';
+        }
+        const log = spawnSync('tail', ['-n', '2000', logFile]);
+        return log.stdout.toString();
+      } catch (e) {
+        logger.error(e);
+        return '读取日志时发生错误';
+      }
+    }
+    return '不支持的日志类型';
   };

The fix replaces execSync with spawnSync, passes arguments as an array to avoid shell interpretation, and adds an allow-list check on options.type.

Detection Methods for CVE-2026-11408

Indicators of Compromise

Web server access logs containing shell metacharacters such as ;, |, &&, backticks, or $() in the type query parameter of the log viewer endpoint.
Unexpected child processes spawned by the vertex Node.js process, such as sh, bash, curl, wget, or nc.
New or modified files under the logs/ directory or unexpected outbound network connections from the host.

Detection Strategies

Monitor process-creation telemetry for node parent processes spawning shell interpreters or networking utilities.
Inspect HTTP request bodies and query strings to the log viewer endpoint for non-alphabetic values in type.
Compare the deployed app/model/LogMod.js against the patched version at commit 805d82e7100d49b79b3beb1b9420e8e458987198 to identify vulnerable installations.

Monitoring Recommendations

Enable verbose application logging for the log viewer route, including full query parameters and source IP.
Forward Node.js process telemetry and host-level execve events to a centralized log platform for correlation.
Alert on any execution of tail, sh, or other binaries spawned from the vertex application path outside of expected operational windows.

How to Mitigate CVE-2026-11408

Immediate Actions Required

Upgrade vertex to a build that includes commit 805d82e7100d49b79b3beb1b9420e8e458987198 or later.
Restrict network exposure of the vertex management and log viewer endpoints to trusted administrators only.
Audit application and system logs for prior exploitation attempts targeting the log viewer endpoint.

Patch Information

The maintainers fixed the issue in commit 805d82e7100d49b79b3beb1b9420e8e458987198 in the GitHub Vertex App Repository. The patch replaces execSync with spawnSync using array arguments and enforces an allow-list on the type parameter. Additional details are available in the VulDB CVE-2026-11408 entry.

Workarounds

Place the vertex application behind a reverse proxy or web application firewall that strips or rejects shell metacharacters in query parameters.
Require authentication and IP-based access controls on the log viewer endpoint until the patch is applied.
Run the vertex Node.js process under a least-privileged service account with restricted shell access to limit post-exploitation impact.

bash

# Example nginx restriction blocking shell metacharacters on the log viewer path
location /api/log {
    if ($args ~* "[;|&\$\`\(\)]") {
        return 403;
    }
    allow 10.0.0.0/8;
    deny all;
    proxy_pass http://127.0.0.1:3000;
}