CVE-2026-16488

What it is

A vulnerability was determined in QUSETIONS MiniCode-Python 0.1.0. This vulnerability affects the function subprocess.Popen of the file minicode/config.py of the component Project File Handler. Executing a manipulation can lead to os command injection. The attack may be launched remotely. A high complexity level is associated with this attack. It is stated that the exploitability is difficult. The exploit has been publicly disclosed and may be utilized. Upgrading to version 0.1.0-rc1 is able to resolve this issue. This patch is called 9d868dc2550f426c6ddf8ee98f30ffe450ca5e32. It is suggested to upgrade the affected component.

At a glance

Exploitability

Can be exploited over the network without logging in, but needs a user to act. Limited direct impact.

Exploit odds

1.5% chance of exploitation in the next 30 days (EPSS).

Fix

A patch, advisory or fixed version is referenced. Upgrade or apply it.

Timeline

1. 2026-07-22 00:17 UTC PublishedDisclosed publicly on CVE.org and NVD
2. 2026-10-24 17:10 UTC Last updatedMost recent change to the record

Details

Published

2026-07-22 00:17 UTC

Last modified

2026-10-24 17:10 UTC

Exploit probability

1.5% · EPSS, next 30 days

Weakness

CWE-77 · Command injection

Record status

Deferred

Attack profile CVSS 4.0 · 1.3

Attack vector

Network

Complexity

High

Attack requirements

None

Privileges needed

None

User interaction

Passive

Confidentiality

Low

Integrity

Low

Availability

Low