# CVE-2026-118869: SHIRASAGI OS command injection in open data harvest import

Source: https://junglewise.ai/threats/cve-2026-118869-an-os-command-injection-vulnerability-exists-in-shirasagi-which  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-05. Updated: 2026-11-05  
License: CC BY 4.0 with a link back

CVE-2026-118869 · Severity: high · CVSS 8.8 · Published 2026-11-05

SHIRASAGI is a content management system used to publish and manage web content and open data. An authenticated administrator can inject arbitrary OS commands through the open data harvest import feature, allowing execution of commands with the privileges of the web server process. This could lead to complete system compromise, data theft, or service disruption.

Technologies: [SHIRASAGI Project SHIRASAGI](https://junglewise.ai/threats/technologies/shirasagi). Vendors: [SHIRASAGI Project](https://junglewise.ai/threats/vendors/shirasagi-project).

## Quick answers

**Is CVE-2026-118869 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-118869 being exploited in the wild.

**How severe is CVE-2026-118869?** High severity, with a CVSS score of 8.8, published 5 November 2026.

**Which products and versions are affected?** SHIRASAGI Project SHIRASAGI v1.19.0 to v1.21.0.

**Is there a fix for CVE-2026-118869?** Yes: fixed in SHIRASAGI v1.21.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-118869 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-118869?** Check whether you run SHIRASAGI Project SHIRASAGI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in SHIRASAGI v1.21.1

## Technical details

CVE-2026-118869 is an OS command injection vulnerability (CWE-78) in SHIRASAGI's open data harvest import functionality. An authenticated attacker with open data management privileges can inject shell metacharacters (e.g., pipes) into the harvest URL field, which are passed unsanitized to a system command. The injected commands execute in the context of the web server process when the user triggers the import action.

## Affected products

- SHIRASAGI Project SHIRASAGI v1.19.0 to v1.21.0

## Timeline

- 2026-11-05: disclosed

## References

- [https://jvn.jp/en/jp/JVN55454512/](https://jvn.jp/en/jp/JVN55454512/)
- [https://www.ss-proj.org/support/1743.html](https://www.ss-proj.org/support/1743.html)

## Related threats

- [SHIRASAGI cross-site scripting in advertisement pages](https://junglewise.ai/threats/cve-2026-117679-a-cross-site-scripting-vulnerability-exists-in-shirasagi-which)
- [SHIRASAGI authorization bypass in shared files](https://junglewise.ai/threats/cve-2026-82582-shirasagi-authorization-bypass-in-shared-files)
- [SHIRASAGI cross-site scripting in guided procedures](https://junglewise.ai/threats/cve-2026-81635-shirasagi-cross-site-scripting-in-guided-procedures)