CVE-2026-7642 — Pskill9 Website-Downloader Command Injection

title: CVE-2026-7642 - Pskill9 Website-Downloader Command Injection via outputPath
id: scw-2026-05-02-ai-1
status: experimental
level: critical
description: |
  Detects the exploitation of CVE-2026-7642 in pskill9 website-downloader. The rule looks for the execution of the node process related to the download_website function with an outputPath argument that appears to be manipulated to inject OS commands, indicated by the presence of common command injection characters like backticks, semicolons, pipes, or logical operators.
author: SCW Feed Engine (AI-generated)
date: 2026-05-02
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-7642/
tags:
  - attack.execution
  - attack.t1059.004
logsource:
    category: process_creation
detection:
  selection:
      Image|startswith:
          - 'C:\Users\'
          - 'C:\Program Files\'
      CommandLine|contains:
          - 'node src/index.ts download_website --outputPath '
      CommandLine|contains:
          - '`'
          - ';'
          - '|'
          - '&&'
          - '||'
      condition: selection
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse