ja-errorpro/cve-2026-54161upsmon: remote OS command injection (RCE) via attacker-controlled ups.alarm in NOTIFYCMD execution
upsmon interpolates the server-supplied, attacker-controllable ups.alarm value, unsanitized, into a shell command that it runs via system(). When a monitored device reports an ALARM state and the operator has configured NOTIFYCMD with EXEC on the ALARM event, an ups.alarm value containing shell command-substitution ($(...) / backticks on POSIX, or a "&…&" quote break-out on Windows ) results in , because runs as root to manage system shutdown.
cmd.exeupsmon user — commonly rootupsmonclients/upsmon.c (notify(), and the WIN32 twins async_notify() and wall()),
driven by the stock NOTIFY_ALARM message in clients/upsmon.h.git master. Not affected: ≤ 2.8.2.
Confirmed by diffing tags v2.8.2 vs v2.8.3: the ups.alarm → NOTIFY_ALARM handling
(ups_is_alarm(), do_notify(…, NOTIFY_ALARM, …), the ups.alarm GET) was introduced in 2.8.3
(via issue #2657 / PR #2658). Verified vulnerable on the shipped packages nut-client 2.8.5
(Fedora 42/43), 2.8.4 (Fedora 41 / Debian sid / ubuntu:rolling), 2.8.3 (Ubuntu 25.10); not
triggered on 2.8.1 (Debian trixie/stable, Ubuntu 24.04 LTS).Please refer to GHSA-mjgp-j4gm-6qg5 to read the full report.