Skip to content
CVE PROGRAM SOURCE RECORD7.3 High

CVE-2026-48098

NexTOR IP Changer Unsafely Uses sudo and shell=True

Description

NexTor IP Changer is a command-line tool that leverages the Tor network to periodically rotate a user's IP address. Versions prior to 2.0.0 execute privileged system commands using `sudo` and `shell=True` directly inside application logic. In environments where passwordless sudo (`NOPASSWD`) is enabled, privileged commands may execute silently without explicit user confirmation. Version 2.0.0 fixes the issue.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

0x5t4l1n NexTOR_IP_CHANGER

  • < 2.0.0affected

References