CVE-2023-38198 : faille critique acme.sh project acme.sh (CVSS 9.8)

acme.sh before 3.0.6 runs arbitrary commands from a remote server via eval, as exploited in the wild in June 2023.

Sévérité

Critique (CVSS 9.8)

Vecteur CVSS

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitation active

Non signalée par la CISA

Publication

13 juil. 2023

Dernière mise à jour

17 juin 2026

• acme.sh project acme.sh

• Fiche CVE-2023-38198 sur le NVD (NIST)
• openwall.com/lists/oss-security/2023/07/13/1
• github.com/acmesh-official/acme.sh/issues/4659
• github.com/acmesh-official/acme.sh/releases/tag/3.0.6
• groups.google.com/a/mozilla…
• news.ycombinator.com/item
• news.ycombinator.com/item
• reddit.com/r/netsec/comments/144ygg7/acmesh_runs_arbitrar…