CVE-2026-44425: ShellHub has crash-DoS via field injection in filter and sort-by parameters

May 6, 2026 (updated May 14, 2026)

The device list endpoint accepts user-controlled identifiers in two places that are passed directly as BSON/SQL keys in the database layer without validation:

The name field of each filter property in the base64-encoded filter query parameter.
The sort_by query parameter.

Any authenticated user can craft payloads that cause the aggregation/query to fail and the API to return HTTP 500 with no body, with no rate limiting applied.

References

github.com/advisories/GHSA-47r2-v3x6-wff9
github.com/shellhub-io/shellhub/security/advisories/GHSA-47r2-v3x6-wff9
nvd.nist.gov/vuln/detail/CVE-2026-44425

Code Behaviors & Features

Detect and mitigate CVE-2026-44425 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →