CVE-2026-37281: Zenshin RCE Vulnerability via Command Injection

CVE-2026-37281 Overview

CVE-2026-37281 is an operating system (OS) command injection vulnerability in the hitarth-gg Zenshin application before version 2.7.0. The flaw resides in the /stream-to-vlc Express route, which passes the url parameter to a shell command without sufficient sanitization. Remote attackers can inject arbitrary shell metacharacters into the url parameter to execute commands on the host running Zenshin. The vulnerability is classified under CWE-78 (Improper Neutralization of Special Elements used in an OS Command). No authentication or user interaction is required for exploitation.

Critical Impact

Unauthenticated remote attackers can execute arbitrary OS commands on systems running Zenshin before 2.7.0, leading to full host compromise.

Affected Products

• hitarth-gg Zenshin versions prior to 2.7.0
• The /stream-to-vlc Express.js route handler
• Any host running a vulnerable Zenshin instance exposed on the network

Discovery Timeline

• 2026-05-19 - CVE-2026-37281 published to NVD
• 2026-05-20 - Last updated in NVD database

Technical Details for CVE-2026-37281

Vulnerability Analysis

Zenshin is a desktop streaming application that integrates with the VLC media player. The application exposes a local Express.js HTTP server with a /stream-to-vlc route. This route accepts a url query parameter intended to be passed to VLC for playback. The handler concatenates the user-supplied url value directly into a shell command string, which is then executed by a child process function such as exec. Because the input is not validated, escaped, or passed as a discrete argument vector, shell metacharacters including ;, &&, |, and backticks are interpreted by the underlying shell.

Root Cause

The root cause is unsafe construction of a shell command from untrusted HTTP input. Node.js child process APIs that invoke a shell, such as child_process.exec, parse the entire command string through /bin/sh or cmd.exe. When the url parameter is interpolated into that string, attackers control the command boundary. Safe alternatives, such as execFile with an argument array or strict allow-list validation of the URL scheme and characters, would prevent the injection.

Attack Vector

An attacker sends a crafted HTTP request to the /stream-to-vlc endpoint with a malicious url parameter. The parameter contains shell separators followed by arbitrary commands. Because Zenshin binds an HTTP listener locally, attackers can reach the endpoint through cross-site request forgery from a browser visiting an attacker-controlled page, through any network exposure of the listener, or through other local processes. Successful exploitation runs commands with the privileges of the Zenshin process. Public proof-of-concept content is referenced in the GitHub PoC Gist.

The vulnerability manifests when the url query parameter is appended to a shell command invoking VLC. See the Zenshin fix commit for the corrected handler implementation.

Detection Methods for CVE-2026-37281

Indicators of Compromise

• HTTP requests to /stream-to-vlc containing shell metacharacters such as ;, &&, ||, |, backticks, or $( in the url parameter
• Child processes of the Zenshin or Node.js parent process spawning shells (sh, bash, cmd.exe, powershell.exe) with unexpected arguments
• Outbound network connections initiated by the Zenshin process to unfamiliar hosts following a /stream-to-vlc request
• VLC launches accompanied by sibling processes unrelated to media playback

Detection Strategies

• Inspect web proxy and host firewall logs for requests to /stream-to-vlc with URL-encoded shell characters in the url parameter
• Correlate Node.js or Electron parent processes with shell child processes using endpoint telemetry
• Apply CWE-78 detection rules that flag command-line strings containing concatenated user input patterns

Monitoring Recommendations

• Alert on any process tree where a Zenshin or node process spawns an interpreter such as sh, bash, powershell, or cmd
• Monitor for new persistence artifacts (cron jobs, scheduled tasks, startup entries) created shortly after Zenshin activity
• Track unusual outbound connections from desktop streaming applications, which typically connect only to torrent trackers and peers

How to Mitigate CVE-2026-37281

Immediate Actions Required

• Upgrade Zenshin to version 2.7.0 or later, which contains the fix referenced in the vendor commit
• Block inbound network access to the Zenshin Express listener on all interfaces except loopback
• Audit hosts that ran vulnerable versions for unexpected processes, scheduled tasks, and outbound connections

Patch Information

The maintainer addressed the issue in Zenshin 2.7.0. The fix replaces unsafe shell command concatenation in the /stream-to-vlc handler with safer argument handling. Users should update from the official Zenshin repository and verify the installed version reports 2.7.0 or higher before re-enabling streaming features.

Workarounds

• Stop the Zenshin application until the upgrade to 2.7.0 is complete
• Restrict the Express listener to 127.0.0.1 and add a host firewall rule denying remote connections to the application port
• Avoid visiting untrusted websites while Zenshin is running to reduce cross-site request forgery exposure to the local endpoint