Critical 9.8Published Sep 2, 2026

CVE-2026-53611Looking Glass: Remote Code Execution via Unanchored Regular Expression in BGPASPath Input Validation

Updated under an hour ago (2026-10-19 07:23 UTC)

Does this affect you?

It affects AS203038 looking-glass. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for AS203038 looking-glass

Exploited in the last 30 days

Looking Glass is a modern, stateless network-diagnostic platform — a single self-contained Go binary that fronts a fleet of routers over SSH and exposes ping / traceroute / BGP lookups through a gRPC (ConnectRPC) API, an embedded SvelteKit web UI, and a lg-cli client. Prior to version 1.3.5, there is an OS Command Injection vulnerability resulting from an unanchored regular expression in the input validation layer. This issue has been patched in version 1.3.5.

CVSS: 9.8 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-78
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: GitHub_M
NVD analysis: Deferred
Record last updated: Sep 2, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

AS203038 looking-glass as203038:looking_glass (from the name)	before 1.3.5	CNA record

References

https://github.com/AS203038/looking-glass/security/advisories/GHSA-8hgf-p844-425mx-refsource-confirm
https://github.com/AS203038/looking-glass/releases/tag/1.3.5x-refsource-misc

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.