---
id: CVE-2026-104584
title: >-
  reNgine up to v2.2.0 and current master branch (commit
  de4199222cca5618f1255930ce78987e47d43a99) is vulnerable to OS Command
  Injection via the custom_headers scan engine configuration field in
  web/reNgine/tasks.py (fetch_url and dir_file…
summary: >-
  reNgine up to v2.2.0 and current master branch (commit
  de4199222cca5618f1255930ce78987e47d43a99) is vulnerable to OS Command
  Injection via the custom_headers scan engine configuration field in
  web/reNgine/tasks.py (fetch_url and dir_file…
severity: none
published: '2026-10-13'
updated: '2026-10-13'
sourceUpdated: '2026-10-13T19:17:55.417'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-104584'
references:
  - url: 'https://github.com/AmalJafarzade/CVE-2026-104584'
    label: cve@mitre.org
  - url: 'https://github.com/yogeshojha/rengine'
    label: cve@mitre.org
tags:
  - nvd
  - exploit-available
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/AmalJafarzade/CVE-2026-104584'
  checkedAt: '2026-10-13T19:44:04.034Z'
exploitAvailable: true
ingestedAt: '2026-10-13T19:43:28.909Z'
---

## Overview

reNgine up to v2.2.0 and current master branch (commit de4199222cca5618f1255930ce78987e47d43a99) is vulnerable to OS Command Injection via the custom_headers scan engine configuration field in web/reNgine/tasks.py (fetch_url and dir_file_fuzz functions).

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.