High · 8.7 CVE-2026-26093 EUVD-2026-7755GHSA-42vx-f9wx-wg3r

Improper Neutralization of Special Elements used in a Command ('Command Injection') in Owl opds

Published Feb 20, 2026 · Updated Feb 20, 2026 · Assigned by Nozomi

Description

Improper Neutralization of Special Elements used in a Command ('Command Injection') in Owl opds 2.2.0.4 allows Command Injection via a crafted network request.

Affected products

Vendor	Product	Affected	Fixed
Owl	opds	≤ 2.2.0.4	—

References

https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2026-26093 third-party-advisory