CVE-2026-8665 is an OS command injection in the TR action of the Rapid7 InsightConnect Translate plugin on Linux (CVSS 7.7, high). The text or expression parameters are not sanitized enough before shell use. Update the plugin. The sections below cover affected versions, how to check your exposure and what to do first.
What's affected
The record names the Translate plugin on Linux and its TR action, which takes text or expression parameters. The weakness is CWE-78, OS command injection. The record gives no fixed version, and the extension page was not readable for me, so use the plugin page to find the current release.
The record is not in the CISA KEV catalog.
How to check if you're exposed
Open the plugin list in InsightConnect, read the Translate plugin version, and compare it with the Rapid7 extension page. Then find workflows that use the TR action and where their text input originates.
What to do now
- Update the Translate plugin to the newest version.
- Find workflows that pass external text into the TR action.
- Filter input so only expected characters reach the plugin, as a short term measure.
- Run orchestrator hosts with the least privilege.
- Remove the plugin where it is not needed.
Why it matters
The tr command transforms characters, and the plugin built a shell command around user values. Text that contains shell syntax can end the intended command and begin another one.
Free text is the hardest input to validate, since almost any character is legitimate. The durable fix is to avoid the shell.
Quick check
Why is the text field the risk?
Free text can contain any characters, so building it into a shell string without escaping lets it change the command.
Sources
Last reviewed: 19 October 2026.
