reNgine: OS command injection via custom_headers scan engine field

Summary

reNgine up to v2.2.0 and the current master branch are vulnerable to OS command injection through the custom_headers field of the scan engine configuration. The field is concatenated into shell commands in the fetch_url and dir_file_fuzz functions without sanitization. According to the researcher, an authenticated user who can edit scan engine configurations can execute arbitrary commands as root in the Celery worker container. A public proof of concept exists, and no fixed version is known.

Affected

• reNgine up to and including v2.2.0
• reNgine master branch at commit de4199222cca5618f1255930ce78987e47d43a99
• Affected component: web/reNgine/tasks.py (fetch_url and dir_file_fuzz)

Fixed in

Unknown.

Workaround

• No official workaround published by the vendor.
• Restrict scan engine configuration rights to trusted administrators.
• Review existing custom_headers values for shell metacharacters such as quotes, ;, | and &&.

Exploitation

• Public proof of concept: yes (GitHub repository by AmalJafarzade).
• CISA SSVC: exploitation status poc, automatable: yes, technical impact: total.
• In the wild: nothing known.
• EPSS score: 0.0074.

Our recommendation

• Do not expose reNgine's web interface or API to the internet; use VPN or an access proxy.
• Limit scan engine configuration rights to a small group of trusted administrators and review existing custom_headers values.
• Run the Celery worker with least privilege and restrict its network access.
• Monitor the worker container for unexpected processes or files.
• Check https://github.com/yogeshojha/rengine regularly and upgrade as soon as a fix is published.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.

• Proof of concept on GitHub (1 repositories) iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).
  AmalJafarzade/CVE-2026-104584

Research sources

• CVE-2026-104584 proof of concept (GitHub, AmalJafarzade) github.com
• reNgine project (GitHub, yogeshojha) github.com
• GitHub Advisory Database GHSA-54m7-7mmj-vwxc github.com
• Vulners NVD record CVE-2026-104584 vulners.com
• VulDB entry 418040 vuldb.com
• Packet Storm exploit entry PACKETSTORM:235093 vulners.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 18:56.