Description
A vulnerability was identified in Linketic CityGaussian up to 2.0. This affects the function parse_cfg_args of the file internal/utils/common.py of the component Sidecar Parsing. The manipulation of the argument cfg_args leads to code injection. The attack can only be performed from a local environment. The project was informed of the problem early through an issue report but has not responded yet.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Linketic | CityGaussian | 2.0 | — |
References
- VDB-416766 | Linketic CityGaussian Sidecar Parsing common.py parse_cfg_args code injection vdb-entry technical-description
- VDB-416766 | CTI Indicators (IOB, IOC, TTP, IOA) signature permissions-required
- CVE-2026-108941 | CVE Analysis and Report third-party-advisory
- Submit #997639 | Linketic / CityGaussian CityGaussian up to CityGaussian_V2.0 (main commit 3c1e93b38712334877ff3cfdf724e4ec7ee3e65b) Code Injection (CWE-94) third-party-advisory
- https://github.com/Linketic/CityGaussian/issues/206 issue-tracking
- https://github.com/Linketic/CityGaussian/ product