CVE-2026-90843: SabyasachiRana WebMap RCE Vulnerability

CVE-2026-90843 Overview

CVE-2026-90843 is an OS command injection vulnerability [CWE-77] in SabyasachiRana WebMap, an open-source web-based dashboard for Nmap scan results. The flaw resides in the nmap_newscan function of functions_nmap.py, part of the New Nmap Scan Handler component. Attackers can manipulate the target and params arguments to inject arbitrary operating system commands. The vulnerability is remotely exploitable and requires no authentication or user interaction. Public disclosure of the exploit has occurred, and the maintainer resolved the issue through a silent patch identified as commit 3d52f65803a2716bff14d938352c6fef45b0cfb6. Affected builds include WebMap up to commit 8b95fe4dc301a3c09ddf145b895de0bf9f8d2a25.

Critical Impact

Remote unauthenticated attackers can execute arbitrary operating system commands on hosts running vulnerable WebMap instances by injecting shell metacharacters into scan parameters.

Affected Products

• SabyasachiRana WebMap up to commit 8b95fe4dc301a3c09ddf145b895de0bf9f8d2a25
• Component: New Nmap Scan Handler (functions_nmap.py)
• Function: nmap_newscan

Discovery Timeline

• 2026-09-15 - CVE-2026-90843 published to the National Vulnerability Database (NVD)
• 2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-90843

Vulnerability Analysis

WebMap acts as a front-end for launching and reviewing Nmap scans. The nmap_newscan function inside functions_nmap.py accepts user-controlled target and params inputs and passes them into an operating system command used to invoke Nmap. The application does not sanitize or validate these inputs before shell interpretation, allowing injection of arbitrary shell metacharacters such as ;, |, &&, or backticks.

Because the New Nmap Scan Handler is reachable over the network and requires no privileges or user interaction, an attacker can submit a crafted scan request to run arbitrary commands under the WebMap process account. Successful exploitation can enable data theft, lateral movement, or use of the host as a pivot into internal networks. See the CalledStriker research write-up and the VulDB entry for supporting analysis.

Root Cause

The root cause is improper neutralization of special elements used in an OS command [CWE-77]. The nmap_newscan function concatenates untrusted target and params values into a shell command string rather than passing them as isolated arguments to a subprocess call with argument arrays. As a result, shell metacharacters supplied by the requester alter the intended command semantics.

Attack Vector

The attack vector is network-based. An attacker submits an HTTP request to the New Nmap Scan Handler endpoint containing a payload embedded in the target or params field. WebMap builds the Nmap invocation string with the attacker input and executes it through a shell interpreter. Any additional commands appended after a metacharacter execute in the same process context as the WebMap application.

No verified exploit code is included here. Refer to the linked research for the disclosed proof-of-concept and the patch commit for the corrected input handling.

Detection Methods for CVE-2026-90843

Indicators of Compromise

• HTTP requests to WebMap scan-creation endpoints containing shell metacharacters such as ;, |, &, $(, or backticks within the target or params parameters.
• Child processes spawned by the WebMap application that are not nmap, particularly shells (sh, bash), interpreters (python, perl), or network tools (curl, wget, nc).
• Outbound network connections from the WebMap host to unfamiliar external endpoints shortly after scan submission.
• Unexpected file creation, cron entries, or SSH key additions in the WebMap service account's home directory.

Detection Strategies

• Inspect application and reverse-proxy access logs for POST requests to WebMap scan endpoints containing URL-encoded shell metacharacters.
• Monitor process ancestry on WebMap hosts and alert on non-nmap children of the WebMap process.
• Deploy web application firewall rules that reject scan parameters not matching a strict IP, hostname, or Nmap-flag allowlist.

Monitoring Recommendations

• Enable command-line and process-creation telemetry on hosts running WebMap and forward events to a centralized analytics pipeline.
• Baseline expected outbound connections from the WebMap host so anomalous egress to attacker-controlled infrastructure is flagged quickly.
• Track file integrity for the WebMap install directory and the service account's shell configuration files.

How to Mitigate CVE-2026-90843

Immediate Actions Required

• Update WebMap to a revision that includes the silent patch commit 3d52f65803a2716bff14d938352c6fef45b0cfb6 or later.
• Restrict network access to the WebMap interface using firewall rules, VPN gating, or reverse-proxy authentication until the patch is applied.
• Run WebMap under a dedicated, least-privileged service account that cannot pivot to other systems or write to sensitive paths.
• Review historical logs for suspicious scan submissions containing shell metacharacters and investigate any matching hosts.

Patch Information

The maintainer released a silent patch in commit 3d52f65803a2716bff14d938352c6fef45b0cfb6 in the SabyasachiRana WebMap repository. Operators should pull the latest revision from upstream and redeploy. Because no versioned release advisory was published, administrators must track the specific commit hash rather than a semantic version.

Workarounds

• Place WebMap behind an authenticating reverse proxy that enforces IP allowlisting and multi-factor authentication.
• Apply strict server-side input validation that limits target to valid IP addresses, CIDR ranges, or hostnames and rejects params values outside a known-good Nmap flag list.
• Run the WebMap container or process with reduced Linux capabilities and a read-only root filesystem to constrain post-exploitation actions.

# Configuration example: fetch and deploy the patched commit
git clone https://github.com/SabyasachiRana/WebMap.git
cd WebMap
git checkout 3d52f65803a2716bff14d938352c6fef45b0cfb6
# Rebuild and redeploy according to your existing container or service workflow