What is GHSA-m95q-vgfj-2v8g?

GHSA-m95q-vgfj-2v8g is a security advisory published by GitHub Security Advisories with High severity. The Gaia OS DynamicCLI daemon runs as root and listens on a world-writable local socket (/tmp...

Which CVE IDs does GHSA-m95q-vgfj-2v8g cover?

GHSA-m95q-vgfj-2v8g covers the following CVE IDs: CVE-2026-123039. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-m95q-vgfj-2v8g?

GHSA-m95q-vgfj-2v8g has a CVSS v3 base score of 7.8, published by GitHub Security Advisories.

GHSA-m95q-vgfj-2v8gHighCVSS 7.8

The Gaia OS DynamicCLI daemon runs as root and listens on a world-writable local socket (/tmp...

Vendor

GitHub Security Advisories

Published

November 12, 2026

Last Modified

November 13, 2026

🔗 CVE IDs covered (1)

CVE-2026-123039 →

📋 Description

The Gaia OS DynamicCLI daemon runs as root and listens on a world-writable local socket (/tmp/dynamic_socket) without authenticating connecting processes. An authenticated local user can send a command to the socket and have it executed as root.

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2026-123039
https://support.checkpoint.com/results/sk/sk1000362
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-123039
https://github.com/advisories/GHSA-m95q-vgfj-2v8g