CVE-2026-19332

Affected software: NellyW8 MCP4EDA 1.0.0. Vulnerable component: run_openlane/view_waveform. Root cause: manipulation of the design_name/vcd_file argument leading to command injection. Impact: partial confidentiality/integrity/availability as per CVSS metrics, with local access required and PoC ex...