CVE-2026-39866

CVE-2026-39866 is a command injection vulnerability in Lawnchair, a free open-source Android home application, found in the release_update.yml workflow dispatch input that allows unauthenticated attackers to execute arbitrary code. The vulnerability affects all versions prior to commit fcba413f55dd47f8a3921445252849126c6266b2, which includes the patched version. The attack exploits the workflow dispatch mechanism without apparent input sanitization, enabling code execution through a relatively straightforward injection technique. While formal CVSS metrics are unavailable, the FAUCET risk score of 47.0/100 indicates moderate concern, though the EPSS score of 0.0029 suggests this vulnerability ranks in the lower percentile relative to other CVEs in terms of prevalence. There is currently no evidence of active exploitation, and this vulnerability has not been added to CISA's Known Exploited Vulnerabilities (KEV) catalog. The issue appears to have limited community attention and is categorized as inactive on threat tracking lists. Organizations using Lawnchair should apply the patch at their earliest convenience, though the immediate exploitation risk appears minimal.