CVE-2026-9155 OS Command Injection in Rapid7 InsightConnect Sed Plugin via expression parameter.
HighCVSS 8.8
EPSS 1.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
OS Command Injection vulnerability in Rapid7 InsightConnect Sed Plugin on Linux allows authenticated attackers to execute arbitrary OS commands via the expression parameter due to insufficient input validation.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Rapid7 InsightConnect Sed Plugin | < 2.0.5 | 2.0.5 |
| GNU Sed | = 4.2.2 | No fix listed |
References
- extensions.rapid7.com vendor-advisory