High severity7.8NVD Advisory· Published Sep 29, 2022· Updated Jun 17, 2026

CVE-2022-40126

Description

A misconfiguration in the Service Mode profile directory of Clash for Windows v0.19.9 allows attackers to escalate privileges and execute arbitrary commands when Service Mode is activated.

Affected products

Clash for Windows/Clash for Windowsdescription
Clash For Windows/Clash for Windowsllm-create
Range: =0.19.9
Fndroid/Clash for Windowsllm-fuzzy
Range: =0.19.9

Patches

Vulnerability mechanics

References

github.com/Fndroid/clash_for_windows_pkg/issues/3405nvdExploitIssue TrackingThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.507
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000