Skip to content
OpenAdvisories
High · 7.4 Public exploit CVE-2026-39866 EUVD-2026-24039

Lawnchair vulnerable to Command Injection via unquoted workflow dispatch input in release_update.yml

Published Apr 21, 2026 · Updated Apr 25, 2026 · Assigned by GitHub_M

Vendor: LawnchairLauncher Product: lawnchair

Description

Lawnchair is a free, open-source home app for Android. Prior to commit fcba413f55dd47f8a3921445252849126c6266b2, command injection in release_update.yml workflow dispatch input allows arbitrary code execution. Commit fcba413f55dd47f8a3921445252849126c6266b2 patches the issue.

Affected products

VendorProductAffectedFixed
LawnchairLauncher lawnchair < fcba413f55dd47f8a3921445252849126c6266b2 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 2 repositories

  • pvharmo2/gha-lab-360f77d0d4 ★ 1 · Sep 6, 2026

    Authorized security-research lab: reproduction of CVE-2026-39866 (GHSA-9prc-pp2c-3427) — workflow_dispatch input template injection in .github/workflows/release_update.yml of LawnchairLauncher/lawnch…

  • abhayclasher/CVE-2026-39866 ★ 0 · Apr 11, 2026

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

References