CVE-2026-44933: Plugin Script Vulnerability Allows Host Binary Execution with Root Privileges

The National Vulnerability Database has identified CVE-2026-44933, a critical vulnerability within PluginScript. This flaw stems from an improper chroot operation, where the plugin attempts to confine itself to a specified root directory. In configurations where this target root is set to the system’s root directory (/), the chroot becomes a no-op. This bypass allows attackers to execute arbitrary host binaries, such as /bin/bash, with root privileges by manipulating traversed paths.

The National Vulnerability Database notes a CVSS score of 7.8 (HIGH) for this vulnerability, with a vector indicating local access, low complexity, no privileges required from the attacker initially, user interaction needed, and a high impact on confidentiality, integrity, and availability. While specific affected products are not detailed, the nature of the vulnerability suggests any system utilizing PluginScript with a standard or misconfigured root directory could be at risk.