{"api_version":"1","generated_at":"2026-05-04T21:51:21+00:00","cve":"CVE-2026-6849","urls":{"html":"https://cve.report/CVE-2026-6849","api":"https://cve.report/api/cve/CVE-2026-6849.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-6849","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-6849"},"summary":{"title":"OS Command Injection in TUBITAK BILGEM's Pardus OS My Computer","description":"Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus OS My Computer allows OS Command Injection.\n\nThis issue affects Pardus OS My Computer: from <=0.7.5 before 0.8.0.","state":"PUBLISHED","assigner":"TR-CERT","published_at":"2026-04-29 16:16:28","updated_at":"2026-04-29 21:13:30"},"problem_types":["CWE-78","CWE-78 CWE-78 Improper neutralization of special elements used in an OS command ('OS command injection')"],"metrics":[{"version":"3.1","source":"iletisim@usom.gov.tr","type":"Primary","score":"8.8","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},{"version":"3.1","source":"CNA","type":"CVSS","score":"8.8","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","data":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"}}],"references":[{"url":"https://www.usom.gov.tr/bildirim/tr-26-0131","name":"https://www.usom.gov.tr/bildirim/tr-26-0131","refsource":"iletisim@usom.gov.tr","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-6849","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-6849","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"TUBITAK BILGEM Software Technologies Research Institute","product":"Pardus OS My Computer","version":"affected <=0.7.5 0.8.0 custom","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[{"source":"CNA","value":"Osman Can VURAL","lang":"en"}],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"6849","cve":"CVE-2026-6849","epss":"0.001040000","percentile":"0.279270000","score_date":"2026-05-03","updated_at":"2026-05-04 00:13:05"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2026-6849","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","timestamp":"2026-04-29T15:35:34.305356Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2026-04-29T15:35:39.447Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"defaultStatus":"unaffected","product":"Pardus OS My Computer","vendor":"TUBITAK BILGEM Software Technologies Research Institute","versions":[{"lessThan":"0.8.0","status":"affected","version":"<=0.7.5","versionType":"custom"}]}],"credits":[{"lang":"en","type":"finder","value":"Osman Can VURAL"}],"datePublic":"2026-04-29T14:36:00.000Z","descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus OS My Computer allows OS Command Injection.<p>This issue affects Pardus OS My Computer: from &lt;=0.7.5 before 0.8.0.</p>"}],"value":"Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus OS My Computer allows OS Command Injection.\n\nThis issue affects Pardus OS My Computer: from <=0.7.5 before 0.8.0."}],"impacts":[{"capecId":"CAPEC-88","descriptions":[{"lang":"en","value":"CAPEC-88 OS Command Injection"}]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-78","description":"CWE-78 Improper neutralization of special elements used in an OS command ('OS command injection')","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-04-29T14:42:29.339Z","orgId":"ca940d4e-fea4-4aa2-9a58-591a58b1ce21","shortName":"TR-CERT"},"references":[{"tags":["third-party-advisory"],"url":"https://www.usom.gov.tr/bildirim/tr-26-0131"}],"source":{"advisory":"TR-26-0131","defect":["TR-26-0131"],"discovery":"UNKNOWN"},"title":"OS Command Injection in TUBITAK BILGEM's Pardus OS My Computer","x_generator":{"engine":"Vulnogram 1.0.2"}}},"cveMetadata":{"assignerOrgId":"ca940d4e-fea4-4aa2-9a58-591a58b1ce21","assignerShortName":"TR-CERT","cveId":"CVE-2026-6849","datePublished":"2026-04-29T14:42:29.339Z","dateReserved":"2026-04-22T08:58:42.292Z","dateUpdated":"2026-04-29T15:35:39.447Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-04-29 16:16:28","lastModifiedDate":"2026-04-29 21:13:30","problem_types":["CWE-78","CWE-78 CWE-78 Improper neutralization of special elements used in an OS command ('OS command injection')"],"metrics":{"cvssMetricV31":[{"source":"iletisim@usom.gov.tr","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"6849","Ordinal":"1","Title":"OS Command Injection in TUBITAK BILGEM's Pardus OS My Computer","CVE":"CVE-2026-6849","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"6849","Ordinal":"1","NoteData":"Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus OS My Computer allows OS Command Injection.\n\nThis issue affects Pardus OS My Computer: from <=0.7.5 before 0.8.0.","Type":"Description","Title":"OS Command Injection in TUBITAK BILGEM's Pardus OS My Computer"}]}}}