{"id":"CVE-2026-94574","title":"A local cross-user code execution vulnerability exists in GNU wget (Windows builds from eternallybored.org) due to a hardcoded configuration file path (C:\\msys64) that is writable by unprivileged users, allowing for arbitrary code execut…","summary":"A local cross-user code execution vulnerability exists in GNU wget (Windows builds from eternallybored.org) due to a hardcoded configuration file path (C:\\msys64) that is writable by unprivileged users, allowing for arbitrary code execut…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":["CWE-427"],"vendor":"GNU Wget (Windows Builds)","product":"Wget","affected":["Wget <= 1.21.4"],"published":"2026-09-22","updated":"2026-09-23","sourceUpdated":"2026-09-23T17:58:00.627","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-94574","references":[{"url":"https://atos.net/en/lp/cybershield/a-tale-of-several-hijacks-and-what-it-taught-me-about-runtime-driven-testing","label":"cret@cert.org"},{"url":"https://eternallybored.org/misc/wget/","label":"cret@cert.org"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-94574.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-94574"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2538740"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-94574"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94574"}],"tags":["nvd","cve.org","csaf","vex","red-hat"],"epss":0.0018,"epssPercentile":0.07538,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-09-23T12:37:21.444599Z"},"ingestedAt":"2026-09-22T20:10:15.102Z","slug":"CVE-2026-94574","body":"## Overview\n\nA local cross-user code execution vulnerability exists in GNU wget (Windows builds from eternallybored.org) due to a hardcoded configuration file path (C:\\msys64) that is writable by unprivileged users, allowing for arbitrary code execution via the use_askpass directive, potentially allowing local privilege escalation.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Important · updated 2026-09-24 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-94574.json)","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":209670,"id":"CVE-2026-94574","ts":1790169918576,"field":"cvss","old":null,"new":"7.8"},{"seq":209669,"id":"CVE-2026-94574","ts":1790169918576,"field":"severity","old":"none","new":"high"}]}