CVE-2026-4745: perf-ninja Code Injection Vulnerability

CVE-2026-4745 Overview

CVE-2026-4745 is a critical code injection vulnerability discovered in the dendibakh perf-ninja project, specifically affecting the labs/misc/pgo/lua modules. This vulnerability is classified as CWE-94 (Improper Control of Generation of Code) and is associated with the program file ldo.C. The flaw allows attackers to inject and execute arbitrary code through improper handling of code generation within the Lua modules used by the perf-ninja performance training framework.

Critical Impact

This vulnerability enables remote attackers to execute arbitrary code without authentication, potentially leading to complete system compromise including unauthorized data access, system manipulation, and further lateral movement within affected environments.

Affected Products

• dendibakh perf-ninja (labs/misc/pgo/lua modules)
• perf-ninja ldo.C component

Discovery Timeline

• 2026-03-24 - CVE-2026-4745 published to NVD
• 2026-03-24 - Last updated in NVD database

Technical Details for CVE-2026-4745

Vulnerability Analysis

This code injection vulnerability exists within the Lua modules of the perf-ninja project, a repository designed for teaching performance optimization techniques. The vulnerability stems from improper control of code generation within the ldo.C file, which handles Lua script execution and dynamic code operations.

The flaw allows an attacker to inject malicious code that gets executed within the context of the application. Since this vulnerability is network-accessible and requires no authentication or user interaction, it presents a significant attack surface. The vulnerability can potentially affect not only the immediate system but also connected systems, as indicated by the scope change potential in the vulnerability assessment.

Root Cause

The root cause of CVE-2026-4745 lies in the ldo.C file within the Lua modules of perf-ninja. The code fails to properly sanitize or validate input before incorporating it into dynamically generated code. This lack of input validation allows specially crafted input to be interpreted as executable code rather than data, enabling code injection attacks.

The vulnerability is classified under CWE-94 (Improper Control of Generation of Code), which occurs when software constructs code segments using externally-influenced input without properly neutralizing or validating that input.

Attack Vector

The attack vector for CVE-2026-4745 is network-based, meaning attackers can exploit this vulnerability remotely without requiring local access to the target system. The exploitation does not require authentication or any user interaction, making it particularly dangerous.

An attacker can craft malicious input that, when processed by the vulnerable ldo.C component, results in the execution of arbitrary code. This could be achieved by sending specially crafted requests or data to the application that processes Lua scripts using the vulnerable perf-ninja modules.

The vulnerability mechanism involves the improper handling of code generation in the Lua modules. When the ldo.C component processes external input, it fails to properly sanitize this input before incorporating it into code execution paths. For detailed technical information, refer to the GitHub Pull Request 129 which addresses this vulnerability.

Detection Methods for CVE-2026-4745

Indicators of Compromise

• Unexpected or anomalous Lua script execution patterns within perf-ninja environments
• Suspicious network connections originating from systems running perf-ninja with Lua modules
• Unusual process spawning or file system modifications associated with Lua interpreter processes
• Log entries indicating malformed or suspicious input to the ldo.C component

Detection Strategies

• Implement network intrusion detection rules to monitor for exploitation attempts targeting Lua code injection patterns
• Deploy application-level logging to capture and analyze input processed by the vulnerable ldo.C component
• Use runtime application self-protection (RASP) solutions to detect and block code injection attempts
• Configure SentinelOne agents to monitor for suspicious Lua interpreter behavior and anomalous code execution

Monitoring Recommendations

• Enable verbose logging for all perf-ninja Lua module operations to capture potential exploitation attempts
• Set up alerts for any unexpected outbound network connections from systems running the vulnerable software
• Monitor for unusual CPU or memory usage patterns that may indicate malicious code execution
• Implement file integrity monitoring on the ldo.C component and related Lua module files

How to Mitigate CVE-2026-4745

Immediate Actions Required

• Identify all deployments of dendibakh perf-ninja that include the vulnerable labs/misc/pgo/lua modules
• Restrict network access to systems running the vulnerable perf-ninja components until patches are applied
• Apply the fix referenced in GitHub Pull Request 129
• Monitor affected systems for any signs of compromise using the detection methods outlined above

Patch Information

The vulnerability is addressed in the changes proposed in GitHub Pull Request 129. Organizations using the affected perf-ninja Lua modules should review and apply these changes as soon as possible. The patch addresses the improper code generation control in the ldo.C file by implementing proper input validation and sanitization mechanisms.

Workarounds

• Disable or remove the vulnerable labs/misc/pgo/lua modules if they are not essential to your workflow
• Implement network segmentation to isolate systems running perf-ninja from untrusted networks
• Deploy a web application firewall (WAF) or similar filtering solution to inspect and block malicious input patterns
• Run perf-ninja components in containerized or sandboxed environments to limit the impact of potential exploitation

# Configuration example: Restricting network access to perf-ninja components
# Add firewall rules to limit access to trusted sources only
iptables -A INPUT -p tcp --dport <perf-ninja-port> -s <trusted-ip-range> -j ACCEPT
iptables -A INPUT -p tcp --dport <perf-ninja-port> -j DROP

# Alternative: Disable the vulnerable Lua modules if not required
# Navigate to the perf-ninja installation directory
# mv labs/misc/pgo/lua labs/misc/pgo/lua.disabled