CVE-2026-104989

CVSS 9.3 (critical) · published 2026-11-09

Uncontrolled search path element in package upload feature in Chaos Software V-Ray versions through 2.0.19 allows remote unauthenticated attackers to execute arbitrary code via redirecting access to libraries

Weakness: CWE-427

Source: NVD CVE-2026-104989

References

• https://documentation.chaos.com/space/VRAYSWARM/1430814721/2.0.21
• https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0043.md

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.