Non évaluée
Clash Verge Rev thru 2.2.3 (fixed in 2.3.0) forces the installation of system services(clash-verge-service) by default and exposes key functions throu...
CVE-2025-50505
Première détection SecPulse
Description d'origine La description telle que publiée par la source (souvent en anglais).
Clash Verge Rev thru 2.2.3 (fixed in 2.3.0) forces the installation of system services(clash-verge-service) by default and exposes key functions through the unauthorized HTTP API /start_clash, allowing local users to submit arbitrary bin_path parameters and pass them directly to the service process for execution, resulting in local privilege escalation.
Références
- advisory github.com
- advisory nvd.nist.gov
- package github.com
- package github.com
- package github.com
- report github.com
- web clashverge.dev