chenhg5 vulnerabilities

Products

• github.com/chenhg5/cc-connect 4

Latest chenhg5 CVEs

Newest publication first

1. CVE-2026-108549 cc-connect through 1.5.0 Missing Authentication via MAX Webhook Sender Spoofing

   Published 2026-10-10

   Critical·CVSS 9.2 EPSS 0.45%

   cc-connect through 1.5.0 contains a missing authentication vulnerability in the MAX platform adapter webhook mode in platform/max/max.go that accepts unauthenticated updates when no webhook_secret is configured. Remote attackers reaching the webhook listener on port 8080 can forg...

2. CVE-2026-92801 cc-connect through 1.5.0 User Allowlist Bypass via Feishu Card Actions

   Published 2026-09-16

   High·CVSS 8.7 EPSS 0.55%

   cc-connect through 1.5.0 fails to enforce per-user allowlist filtering in the onCardAction handler for Feishu interactive card callbacks. Attackers can dispatch agent commands by triggering card actions in admitted chats, bypassing the per-user access controls that protect the te...

3. CVE-2026-76761 chenhg5 cc-connect Management API engine.go shellExecCommand os command injection

   Published 2026-08-19

   Medium·CVSS 6.9 EPSS 2.1%

   A vulnerability was identified in chenhg5 cc-connect up to 1.4.1. This affects the function shellExecCommand of the file core/engine.go of the component Management API. Such manipulation of the argument exec leads to os command injection. It is possible to launch the attack remot...

4. CVE-2026-76760 chenhg5 cc-connect webhook.go authenticate code injection

   Published 2026-08-19

   Medium·CVSS 6.9 EPSS 0.54%

   A vulnerability was found in chenhg5 cc-connect up to 1.4.1. Affected by this vulnerability is the function Authenticate of the file core/webhook.go. The manipulation of the argument exec results in code injection. The attack may be performed from remote. The exploit has been mad...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.