Progress Software Chef InSpec vulnerabilities

Latest Progress Software Chef InSpec CVEs

Newest publication first

1. CVE-2025-6723 Untrusted user data can lead to privilege escalation

   Published 2026-01-30

   Medium·CVSS 5.8

   Chef InSpec versions up to 5.23 and before 7.0.107 creates named pipes with overly permissive default Windows access controls. A local attacker may interfere with the pipe connection process and exploit the insufficient access restrictions to assume the InSpec execution context,...

2. CVE-2023-42658 InSpec Archive Command Vulnerable to Maliciously Crafted Profile

   Published 2023-10-31

   High·CVSS 7.8

   Archive command in Chef InSpec prior to 4.56.58 and 5.22.29 allow local command execution via maliciously crafted profile.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.