# CVE-2026-44425: ShellHub field injection in device list endpoint

Source: https://junglewise.ai/threats/cve-2026-44425-shellhub-field-injection-in-device-list-endpoint  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-13. Updated: 2026-05-18  
License: CC BY 4.0 with a link back

CVE-2026-44425 · Severity: medium · CVSS 5.4 · Published 2026-05-13

ShellHub is a centralized gateway used to manage and access remote servers via SSH. A vulnerability in the device listing feature allows logged-in users to send specially crafted database queries that cause the system to crash or return errors. This can be used to disrupt service availability, flood system logs with errors, or potentially slow down the database through complex search requests.

Technologies: [github.com/shellhub-io/shellhub (Go)](https://junglewise.ai/threats/technologies/github-com-shellhub-io-shellhub), [ShellHub](https://junglewise.ai/threats/technologies/shellhub). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [ShellHub](https://junglewise.ai/threats/vendors/shellhub).

## Quick answers

**Is CVE-2026-44425 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-44425 being exploited in the wild.

**How severe is CVE-2026-44425?** Medium severity, with a CVSS score of 5.4, published 13 May 2026.

**Which products and versions are affected?** github.com/shellhub-io/shellhub (Go) <= 0.24.1, SEMVER:introduced=0,fixed=0.24.2; ShellHub < 0.24.2, <= 0.24.1.

**Is there a fix for CVE-2026-44425?** Yes. github.com/shellhub-io/shellhub (Go): upgrade to 0.24.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-44425 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-44425?** Check whether you run github.com/shellhub-io/shellhub (Go) or ShellHub at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/shellhub-io/shellhub (Go): upgrade to 0.24.2 or later

  ```sh
  go get github.com/shellhub-io/shellhub@v0.24.2
  ```


## Technical details

A field injection vulnerability exists in ShellHub's device list endpoint due to improper validation of user-supplied keys in the 'filter' (base64-encoded) and 'sort_by' query parameters. These values are passed directly as BSON keys in the MongoDB aggregation pipeline within 'api/store/mongo/query-options.go'. An authenticated attacker can inject MongoDB operators (e.g., $where, $regex) or internal field names to trigger server-side errors (HTTP 500), cause log exhaustion, or perform blind regex extraction. The lack of rate limiting on these requests further facilitates resource exhaustion or ReDoS attacks on large datasets. The issue is resolved in version 0.24.2 by implementing stricter input validation.

## Affected products

- ShellHub ShellHub < 0.24.2

## Identifiers

- CVE-2026-44425
- GHSA-47r2-v3x6-wff9
- GO-2026-5113

## Timeline

- 2026-04-29: advisory: GitHub Security Advisory published by vendor
- 2026-05-13: disclosed: CVE published to NVD
- 2026-05-13: patched: Fix confirmed in version 0.24.2

## References

- [https://github.com/shellhub-io/shellhub/security/advisories/GHSA-47r2-v3x6-wff9](https://github.com/shellhub-io/shellhub/security/advisories/GHSA-47r2-v3x6-wff9)

## Related threats

- [ShellHub authorization bypass in namespace API via API Key authentication](https://junglewise.ai/threats/cve-2026-44426-shellhub-authorization-bypass-in-namespace-api-via-api-key)
- [ShellHub authorization bypass in device API](https://junglewise.ai/threats/cve-2026-44424-shellhub-authorization-bypass-in-device-api)
- [ShellHub IDOR in session API allows cross-tenant data disclosure](https://junglewise.ai/threats/cve-2026-44423-shellhub-idor-in-session-api-allows-cross-tenant-data-disclosure)