Chenhg5 vulnerabilities
We track 4 vulnerabilities in Chenhg5 products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on October 10, 2026.
Latest Chenhg5 vulnerabilities
- 8.1 High severity
cc-connect: Missing Authentication for Critical Functionality
cc-connect through 1.5.0 contains a missing authentication vulnerability in the MAX platform adapter webhook mode in platform/max/max.go that accepts unauthenticated updates when no webhook_secret is configured. Remote attackers reaching the webhook listener o
- 8.8 High severity
cc-connect: Incorrect Authorization
cc-connect through 1.5.0 fails to enforce per-user allowlist filtering in the onCardAction handler for Feishu interactive card callbacks. Attackers can dispatch agent commands by triggering card actions in admitted chats, bypassing the per-user access controls
- 7.3 High severity
cc-connect: Improper Neutralization of Special Elements used in a Command
A vulnerability was identified in chenhg5 cc-connect up to 1.4.1. This affects the function shellExecCommand of the file core/engine.go of the component Management API. Such manipulation of the argument exec leads to os command injection. It is possible to lau
- 7.3 High severity
cc-connect: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in chenhg5 cc-connect up to 1.4.1. Affected by this vulnerability is the function Authenticate of the file core/webhook.go. The manipulation of the argument exec results in code injection. The attack may be performed from remote. The