Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
An OS command injection vulnerability in wg-easy 15.3.0 allows injection of newline-delimited WireGuard PostUp directives into the client name field. The client name is written to the WireGuard configuration file without neutralizing newline characters, enabling arbitrary directives to be injected and executed by wg-quick with root privileges.
An authenticated user with clients.create permission can execute arbitrary OS commands as root on the host system by injecting malicious directives into the client name field.
There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.
Update wg-easy to a patched version that sanitizes newline characters in the client name field to prevent directive injection into WireGuard configuration files. Restrict the clients.create permission to trusted users only. Consider running wg-easy with reduced privileges where possible.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Feedly found the first article mentioning CVE-2026-72603 . See article
NVD published the first details for CVE-2026-72603
A CVSS base score of 9.9 has been assigned.
GitHub Advisories released a security advisory .
[GHSA-g5jq-gh88-3gmw] An OS command injection vulnerability in wg-easy 15.3.0 allows users with the cl
Critical OS Command Injection Vulnerability in wg-easy 15.3.0 Disclosed
CVE-2026-72603 - Exploits & Severity - Feedly
wg-easy wg-easy - OS Command InjectionAn OS command injection vulnerability i...
Collect, analyze, and vulnerability reports faster using AI
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
