CVE-2023-50094 is a high severity (CVSS 8.8) OS command injection flaw in reNgine, the open source reconnaissance framework, before version 2.1.2. A user with a valid session can pass shell metacharacters to the WAF detector API and have them run as root. Upgrade to 2.1.2 or later.
What's affected
- reNgine before 2.1.2, per the NVD record.
- Fixed in 2.1.2 according to the record. One discrepancy to note: the 2.1.2 release notes we read list a security fix for a WAF detection command injection under a different identifier, CVE-2024-41661, and do not name CVE-2023-50094. They describe the same tool, so confirm in the project advisories that your build includes the fix.
- Attacker needs a valid session ID. The vector is network reachable with low privileges (AV:N/AC:L/PR:L/UI:N).
- Impact in the record: commands run as root through subprocess.check_output.
- KEV status: the record shows kev as false.
How to check if you're exposed
reNgine is usually deployed from a Git checkout with Docker Compose. From the install directory, check the version you run.
git describe --tags
git log -1 --format=%H
Compare the result with 2.1.2. If you installed from a release archive instead, the release tag is in the folder name or in the web UI footer. Also check who holds accounts on the instance, since any valid session is enough to reach the flaw.
What to do now
- Upgrade reNgine to 2.1.2 or later and rebuild the containers.
- Do not expose the reNgine web interface to the internet. Put it behind a VPN or an allow list.
- Review the accounts on the instance and remove any you do not recognise. Rotate passwords and API keys stored in it.
- Look at your access logs for requests to the waf_detector endpoint with unusual url values.
- Because the commands run as root inside the deployment, treat any suspected abuse as a full host compromise and rebuild.
Why it matters
This is CWE-78, improper neutralization of special elements in an OS command. The application takes a URL from the request and builds a shell command from it. If the input is not validated or passed as a safe argument list, characters that the shell treats as separators change what runs. The record names the call as subprocess.check_output.
The class is common in tools that wrap command line scanners, because the shortcut is to concatenate the target into a string. The safer pattern is to pass arguments as a list, avoid the shell entirely, and validate the target against a strict format before use. reNgine itself is a security tool, which makes it a good target: it often holds scan results and credentials for many systems.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Do I need an account to exploit this?
Yes. The record says the adversary needs a valid session ID, so unauthenticated visitors are not enough, but any logged in user is.
Does the 2.1.2 release notes mention this exact CVE?
The notes we read name CVE-2024-41661 for the WAF detection fix and do not name CVE-2023-50094, so check the project advisories to confirm.
Sources
- NVD record for CVE-2023-50094 and the referenced commits
- reNgine releases
Last reviewed: 19 October 2026.
