Critical severityNVD Advisory· Published Nov 9, 2026· Updated Nov 9, 2026

CVE-2026-104989

Description

Uncontrolled search path element in package upload feature in Chaos Software V-Ray versions through 2.0.19 allows remote unauthenticated attackers to execute arbitrary code via redirecting access to libraries

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Chaos/V-Rayllm-create
Range: <=2.0.19
Chaos Software/V-Rayllm-fuzzy
Range: <=2.0.19

Patches

Vulnerability mechanics

References

documentation.chaos.com/space/VRAYSWARM/1430814721/2.0.21nvd
github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0043.mdnvd

News mentions

No linked articles in our index yet.

cvss	0.585
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000