h-ui: Command injection in administrative API via listen field
Summary
h-ui, a web panel for managing Hysteria2, passes the listen configuration field unvalidated into nftables/iptables rule strings that are run with bash -c as root. An authenticated administrator who submits shell metacharacters can execute arbitrary operating system commands with root privileges, which compromises the whole server. The CVSS 3.1 vector (9.1, Critical) assumes no privileges are required, while the description requires admin credentials, so the real risk depends on how exposed the panel is and how strong its admin credentials are.
Affected
- h-ui up to and including v0.0.25 (CNA record: 0.0.25)
- The OSV version range appears to contain a data error and should be verified against the repository history
Fixed in
Unknown. No fixed version or patch has been published that could be verified.
Workaround
- Do not expose the h-ui admin interface to the internet; restrict access to a VPN, management network or source-IP allowlist
- Use a unique, strong admin password and remove unused admin accounts
- Add MFA via a reverse proxy if the setup allows it
- Review existing listen values for unexpected shell characters without testing with payloads
Exploitation
- CISA SSVC: exploitation none, automatable yes, technical impact total
- No public proof of concept or evidence of exploitation found; not verified in the CISA KEV catalogue
Our recommendation
- If h-ui runs on an internet-facing server, restrict access now or take it offline until a fixed version is available
- Check the live release page for a fix and update as soon as one is published
- Monitor for unexpected nftables/iptables rule changes, unknown child processes of the h-ui service and unusual admin logins
- If exposure or compromise is suspected, rebuild the host, because root access compromises the whole server
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- OSV: CVE-2026-107202 osv.dev
- OpenCVE: CVE-2026-107202 app.opencve.io
- VulDB: CVE-2026-107202 vuldb.com
- Positive Technologies: PT-2026-107538 vulners.com
- Vulners (Mend): CVE-2026-107202 vulners.com
- h-ui GitHub repository github.com
- h-ui releases github.com
- h-ui issue 6 github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 07:18.
Original description (NVD)
A command injection vulnerability exists in the h-ui (version v0.0.25 and below) administrative API due to improper validation of the listen configuration field. When an authenticated administrator submits a value containing shell metacharacters, the application constructs nftables/iptables rule strings using fmt.Sprintf and executes them via bash -c as root. Because the listen field lacks port or format validation, arbitrary OS commands can be injected and executed with root privileges.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.