CVE-2026-25047

> 文章来源: Exploit-DB

> 抓取时间: 202605050803

> 原文 ID: article_756

> 生成时间: 2026-05-05 14:17

基础信息

字段值 CVECVE-2026-25047 CVSS 估计9.0+ 漏洞类型command_injection, auth_bypass, prototype_pollution, dos 受影响组件deephas 1.0.7

漏洞摘要

[webapps] deephas 1.0.7 - Prototype Pollution

根因分析

command_injection, auth_bypass, prototype_pollution, dos

攻击向量

详见原文

PoC / 关键代码

# Google Dork: N/A
# Date: 2026-02-01
# Exploit Author: Mohammed Idrees Banyamer
# Author Country: Jordan
# Instagram: @banyamer_security
# Vendor Homepage: https://www.npmjs.com/package/deephas
# Software Link: https://github.com/sharpred/deepHas
# Version: <= 1.0.7 (fixed in 1.0.8 and later)
# Tes

修复建议

Tested on: Node.js 16 / 18 / 20 (Linux / macOS / Windows)

Semgrep 检测 Hint

- id: auto-hint-cve_2026_25047
  pattern: 'os.system($CMD)'
  message: "Potential command_injection - 参考 CVE-2026-25047"
  severity: WARNING
  languages: [python]

标签

command_injection, auth_bypass, prototype_pollution, dos

*由 vuln_card_gen.py 自动生成，来源: Exploit-DB*

🤖 漏洞情报系统自动分析生成 · 2026-07-02