SB2026082425 - Multiple vulnerabilities in Sakura Editor

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026082425

SB2026082425 - Multiple vulnerabilities in Sakura Editor

Published: August 24, 2026 Updated: August 25, 2026

Security Bulletin ID SB2026082425
CSH Severity
High
Patch available
YES
Number of vulnerabilities 7
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 57% Medium 43%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 7 vulnerabilities.


1) OS Command Injection (CVE-ID: CVE-2026-59561)

CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary shell commands on the target system.

The vulnerability exists due to improper input validation in the "Open Terminal" functionality. A remote attacker can trick a victim to edit a file in a crafted directory and execute arbitrary OS commands on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


2) Stack-based buffer overflow (CVE-ID: N/A)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to stack-based buffer overflow in CEditView::ViewDiffInfo command line construction in CEditView_Diff.cpp when processing overly long file paths for diff display. A local user can supply two files with a combined path length of 978 characters or more and trigger the diff display feature to cause a denial of service.

Exploitation requires diff.exe to be present in the same folder as sakura.exe, and long path support on Windows 10 or later makes the issue easier to trigger.


3) Stack-based buffer overflow (CVE-ID: N/A)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to stack-based buffer overflow in Command_TagsMake command line construction in CViewCommander_TagJump.cpp when building the ctags execution command line. A local user can provide overly long tag options to cause a denial of service.

The advisory notes that current input constraints prevent overflow in the described configuration, but the command construction uses an unbounded wrapper.


4) Stack-based buffer overflow (CVE-ID: N/A)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to stack-based buffer overflow in CProcessFactory::StartControlProcess when processing a crafted profile name passed through the command line. A local user can supply an overly long -PROF= argument to execute arbitrary code.

Exploitation requires control over the command-line arguments used to start the application, such as through a modified shortcut or batch script.


5) Stack-based buffer overflow (CVE-ID: N/A)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to stack-based buffer overflow in CEditView::ExecCmd when processing a crafted WSH macro or overly long command string. A remote attacker can trick the victim into executing a crafted .js or .vbs macro file to cause a denial of service.

User interaction is required to execute the crafted macro file. The issue can also be triggered through the external command execution dialog with a sufficiently long command string.


6) Improper access control (CVE-ID: N/A)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute attacker-controlled code with repository write privileges and access repository secrets.

The vulnerability exists due to improper access control in the GitHub Actions pull_request_target workflow when processing a fork-based pull request on the opened event. A remote attacker can open a crafted pull request containing modified build scripts to execute attacker-controlled code with repository write privileges and access repository secrets.

No maintainer approval is required, and the workflow can run for a first-time contributor immediately upon pull request creation.


7) Code Injection (CVE-ID: N/A)

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code and disclose sensitive information.

The vulnerability exists due to improper control of generation of code in the .github/workflows/sonarscan.yml workflow when processing pull_request_target events that check out and execute pull request head content. A remote attacker can open a crafted pull request from a fork to execute arbitrary code and disclose sensitive information.

The workflow runs in a privileged context with repository secrets and a writable GITHUB_TOKEN, and the advisory describes two execution paths, including an unconditional path through the Install Locale Emulator step.


Remediation

Install update from vendor's website.

References