---
id: CVE-2026-104584
title: >-
  reNgine up to v2.2.0 and current master branch (commit
  de4199222cca5618f1255930ce78987e47d43a99) is vulnerable to OS Command
  Injection via the custom_headers scan engine configuration field in
  web/reNgine/tasks.py (fetch_url and dir_file…
summary: >-
  reNgine up to v2.2.0 and current master branch (commit
  de4199222cca5618f1255930ce78987e47d43a99) is vulnerable to OS Command
  Injection via the custom_headers scan engine configuration field in
  web/reNgine/tasks.py (fetch_url and dir_file…
severity: critical
published: '2026-10-13'
updated: '2026-10-13'
sourceUpdated: '2026-10-13T19:17:55.417'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-104584'
references:
  - url: 'https://github.com/AmalJafarzade/CVE-2026-104584'
    label: cve@mitre.org
  - url: 'https://github.com/yogeshojha/rengine'
    label: cve@mitre.org
tags:
  - nvd
  - exploit-available
  - cve.org
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/AmalJafarzade/CVE-2026-104584'
  checkedAt: '2026-10-27T16:54:08.055Z'
exploitAvailable: true
ingestedAt: '2026-10-13T19:43:28.909Z'
epss: 0.01594
epssPercentile: 0.75577
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-10-19T17:50:10.922212Z'
cvssSource: adp
---

## Overview

reNgine up to v2.2.0 and current master branch (commit de4199222cca5618f1255930ce78987e47d43a99) is vulnerable to OS Command Injection via the custom_headers scan engine configuration field in web/reNgine/tasks.py (fetch_url and dir_file_fuzz functions).

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.