CVE-2023-43449 is a high severity (CVSS 8.8) code injection flaw in HummerRisk, an open source security tool. An authenticated attacker can run arbitrary code through the service/LicenseService component. The record names versions through 1.4.1. The maintainers say the license check is being removed, so confirm your release.
What's affected
The record lists HummerRisk and describes the affected range as version 1.10 through 1.4.1. There is a source conflict. The GitHub issue that the record references says the problem affects v1.1.0 through the latest version at the time, v1.4.1. The record's 1.10 looks like a typo of 1.1.0, but I cannot confirm that, so treat the start of the range as unclear and check anything from 1.1.0 upward.
The issue says the validateLicense method in LicenseService adds the content of a user uploaded file to the command used to verify a license, and a helper that runs commands treats the string as a command. The issue author suggests calling the validator program without adding user input to the command line.
The maintainers replied that the xpack features will be open sourced, the license check will be removed, and the related API will go away, so the issue will no longer exist afterwards. That is a statement of intent in an issue thread, not a fixed version number. The weakness is CWE-94, code injection.
How to check if you're exposed
Find the HummerRisk version you run. In the web interface it appears in the footer or system settings. For a source or container deployment, check the release tag or the image tag:
docker images | grep -i hummer
Then ask whether the license upload function is reachable and who can use it. Review which users have access to system administration screens and the upload feature. Check the host for unexpected processes started by the application user.
What to do now
- Confirm which HummerRisk versions you run, and whether any is from 1.1.0 through 1.4.1.
- Check the project's releases for a version in which the license validation is removed, and read its notes before upgrading.
- Restrict the application to administrators and trusted networks.
- Run the service as a low privilege user, in a container with no extra rights.
- Review application and host logs for license upload actions you cannot explain.
- If you cannot upgrade, block the license related endpoints at your reverse proxy.
Why it matters
Passing user supplied content into a shell command is one of the oldest ways to get code execution. The class, CWE-94, covers code that builds and runs commands from input that has not been neutralized. The safe pattern is to call programs with fixed arguments and never build a command string from input.
The record rates this as network based and needing a low privilege account, with high impact on all three measures. In a security tool that may hold cloud credentials, command execution on the host can expose those credentials. The KEV flag is false. Because the maintainers plan to remove the feature, upgrading beyond it may be the real fix.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which version fixes it?
I could not confirm one. The maintainers say the license check will be removed in a later release, so read the release notes of the version you move to.
Sources
Last reviewed: 19 October 2026.
