Critical · 9.2 CVE-2026-2333 EUVD-2026-7754GHSA-q2ch-643m-222m

Improper Neutralization of Special Elements used in a Command ('Command Injection') in Owl opds

Published Feb 20, 2026 · Updated Feb 20, 2026 · Assigned by Nozomi

Description

Improper Neutralization of Special Elements used in a Command ('Command Injection') in Owl opds 2.2.0.4 allows Command Injection via a crafted network request.

Affected products

Vendor	Product	Affected	Fixed
Owl	opds	≤ 2.2.0.4	—

References

https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2026-2333 third-party-advisory