rootpwn

critical · CVSS v3 9.8 · CVSS v4 4.8 · EPSS 0.00154

CVE-2026-91784

cjbassi/gotop 3.0.0 is vulnerable to local argument injection via its process termination feature. An attacker can craft a process name begi

Overview

cjbassi/gotop 3.0.0 is vulnerable to local argument injection via its process termination feature. An attacker can craft a process name beginning with "--" to cause pkill to interpret it as an option, leading to unintended termination of all processes owned by a target user. This flaw can allow local privilege escalation and denial of service.

Description

cjbassi/gotop is vulnerable to local argument injection via process termination functionality. The process name is passed directly to pkill without sanitization. A local attacker can create a process with a crafted name beginning with -- (e.g. containing a target user's UID). When the user running gotop invokes the kill feature on that process, pkill interprets the crafted name as a command-line option, terminating all processes owned by the targeted user. Product is no longer actively supported and the vulnerabilities have not been fixed. Vulnerability was confirmed at version 3.0.0; other versions were not tested but may also be affected.

Impact

The vulnerability compromises confidentiality by allowing an attacker to terminate processes of other users, integrity by disrupting legitimate workloads, and availability by causing denial of service. It affects any system where gotop is installed and run by a user with local access, potentially impacting all users on the host.

Remediation

Upgrade to a patched version of gotop once available, or remove the kill feature by disabling the process termination command. As an interim measure, run gotop under a restricted user account and restrict pkill usage via sudoers or container isolation. Monitor for unexpected process terminations.

Risk context

Severity is critical with CVSS 9.8 and low EPSS of 0.00154, indicating a high severity but low likelihood of exploitation in the wild. Defenders should treat it as a high-priority issue for systems running gotop.

Affected products

  • cjbassi/gotop 3.0.0
  • cjbassi/gotop

Scores

Severity
critical
CVSS v2
7.5
CVSS v3
9.8
CVSS v4
4.8
EPSS
0.00154

argument-injection local-privilege-escalation process-termination gotop critical denial-of-service

← All CVEs

Related CVEs

critical

CVE-2026-104414

Ghost from 2.5.0 before 6.64.0 contains a stored cross-site scripting vulnerability that allows attackers to inject untrusted scripts into post content via oEmbed photo responses. Attackers can host malicious oEmbed photo responses so that embedding their URL stores scripts that run in the Ghost editor, published site, and newsletter emails, compromising staff admin sessions.

View analysis

critical

CVE-2026-92536

The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.17.4 via the get_user_profile_structure. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract other users' email addresses, login names, and registration dates via the Member Directory's per-row user rebinding when attacker-controlled base64 payloads in the [pp-custom-html] shortcode invoke [profile-email], [profile-username], and [profile-date-registered]. When the WordPress users_can_register option is enabled, unauthenticated attackers can also exploit this vulnerability by supplying the split shortcode fragments through the plugin's own registration handler, which processes the reg_nickname and reg_bio fields without a nonce requirement.

View analysis

critical

CVE-2026-97644

The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Privilege Escalation via Contact Identity Rebinding in all versions up to, and including, 4.9 The vulnerability exists because the `create_contact` function in the v3 REST endpoint (`POST /gh/v3/contacts`) is gated solely by the `add_contacts` capability and forwards the full request payload — including the security-bearing `user_id` column — into the upsert path of `Contacts_DB::add()`, which bypasses the ownership guard that `Contacts_DB::update()` enforces, allowing an attacker to rebind any existing contact record to an arbitrary WordPress user ID. This makes it possible for authenticated attackers with Sales Representative-level access and above to upsert their own contact row to point to an Administrator's user ID, then invoke the v4 email-test endpoint (`POST /gh/v4/emails/test`) — also accessible to the Sales Representative role via the `send_emails` capability — to generate an `{auto_login_url}` one-time permissions key bound to the rebound contact, and consume that link to call `wp_set_auth_cookie()` and gain a fully authenticated session as the WordPress Administrator.

View analysis

critical

CVE-2026-101923

The Photo Reviews for WooCommerce plugin for WordPress is vulnerable to Arbitrary Content Deletion in versions up to, and including, 1.2.30. This is due to the plugin storing attacker-controlled post IDs from the wcpr_image_upload_id parameter of a public review submission into the review's reviews-images comment meta without verifying that the IDs correspond to attachments owned by the submitter, combined with the delete_reviews_image() handler unconditionally calling wp_delete_post( $id, true ) on every stored ID when the review is deleted. This makes it possible for unauthenticated attackers to permanently delete arbitrary posts, pages, products, or media attachments on the site whenever an administrator subsequently deletes the attacker's review (or when WordPress's built-in wp_scheduled_delete cron empties the comment trash after 30 days).

View analysis