CVE-2026-53611

CVE-2026-53611 is an OS command injection vulnerability (CWE-78) in the Looking Glass network-diagnostic platform, caused by an unanchored regular expression in its input validation layer that fails to fully constrain user-supplied values. Because the regex is not anchored, an attacker can craft ping, traceroute, or BGP lookup input — submitted through the ConnectRPC (gRPC) API or the embedded SvelteKit web UI — that bypasses validation and injects operating system commands into the commands the platform executes when querying routers over SSH. A remote, unauthenticated attacker (CVSS: AV:N/AC:L/PR:N/UI:N) gains arbitrary command execution with high impact on confidentiality, integrity, and availability, in the context of the Looking Glass process and/or the SSH sessions it uses to reach the routers it fronts. All deployments running Looking Glass before version 1.3.5 are affected, including the single self-contained Go binary, the embedded web UI, and the lg-cli client. As of now there is no evidence of exploitation: the flaw is not in CISA KEV, no public proof-of-concept is known, and EPSS estimates only about a 1% chance of exploitation in the next 30 days.

What to do: Upgrade to Looking Glass version 1.3.5, which fixes the unanchored-regex input validation flaw. Until patched, restrict network access to the ConnectRPC/gRPC API and embedded web UI (firewall or allowlist trusted clients), and review logs on the looking-glass host and its routers for unexpected or injected commands executed over SSH.