VulnerabilityDeferred

CVE-2026-78971

In Halo <= 2.25.4, the plugin management feature allows users to install/update malicious plugins, which could let attackers execute any command with Halo process permissions.

UnscoredEPSS 0.16%

Does this matter?

Not yet scored. NVD analysis is pending; check back once CVSS and EPSS values are published.

Description

In Halo <= 2.25.4, the plugin management feature allows users to install/update malicious plugins, which could let attackers execute any command with Halo process permissions.

CVSS: Not yet scored
EPSS: 0.16% probability · 5th percentile
CISA KEV: Not listed
Source: cve@mitre.org

References

https://github.com/LING12138-sg/MyCVE-Report/issues/1
https://github.com/halo-dev/halo

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.