CVE-2026-90770

Spug, an open-source self-hosted operations and monitoring platform, contains an OS command injection flaw (CWE-78) through version 3.4.0 in the ping_check function of its monitoring module, where user-supplied monitor addresses are interpolated directly into shell commands without any validation. An authenticated attacker with monitor permissions can trigger the flaw by sending shell metacharacters in a monitor address to the /monitor/run_test/ endpoint, causing arbitrary commands to execute as the Spug process user. Because Spug consoles typically store SSH keys, deployment credentials, and API tokens for managed infrastructure, successful exploitation gives an attacker a foothold that extends well beyond the application itself. Any self-hosted deployment running Spug 3.4.0 or earlier with semi-trusted users holding monitor permissions is affected. No public proof of concept is known and the issue is not on CISA's KEV list, so exploitation is currently assessed as none known.

What to do: Check the official Spug repository for a release newer than 3.4.0 that fixes the ping_check flaw and upgrade as soon as one is available; no fixed version is identified in the advisory itself. In the meantime, restrict monitor permissions to fully trusted accounts and keep the Spug web console off the public internet (VPN or authenticated reverse proxy). Review logs for requests to /monitor/run_test/ containing shell metacharacters such as ; | $ ( ` and rotate any SSH keys or credentials stored in Spug if suspicious activity is found.