CVE-2026-76760

creationtimestamp| type| source ---|---|--- 2026-08-20 17:10:46+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mtjqgwi5nb2a 2026-08-20 17:11:16+00:00| seen| https://mastodon.social/users/hugovalters/statuses/117128943795081747...

CVE-2026-76760

In chenhg5 cc-connect up to version 1.4.1, the Authenticate function in core/webhook.go injects the attacker-controlled exec argument directly into command execution, enabling unauthenticated remote code injection over the network. CVSS 3.1 rates this HIGH (7.3). No patch version or exploit detai...