CVE-2026-30309

CVE-2026-30309 identifies a critical command filtering vulnerability in InfCode's terminal auto-execution module, where its blacklist mechanism is ineffective against obfuscated PowerShell commands. This flaw allows an attacker to bypass security controls through simple syntax obfuscation, enabling arbitrary command execution or sensitive data leakage when a user imports and views a malicious file. With a CVSS score of 7.8 High, the vulnerability poses a significant risk to confidentiality, integrity, and availability, requiring user interaction but with low attack complexity. Currently, there are no known public exploits or evidence of active exploitation, though the vulnerability has received minimal discussion within cybersecurity communities.