CVE-2022-40126

7.8 highEPSS 0.3%

High (7.8) in clash project clash. EPSS 0.3% chance of exploitation in the next 30 days.

A misconfiguration in the Service Mode profile directory of Clash for Windows v0.19.9 allows attackers to escalate privileges and execute arbitrary commands when Service Mode is activated.

Severity

CVSS 3.1

7.8 high

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 24% of CVEs (scores of 2026-10-31)
CWE: CWE-552
Published: 2022-09-29
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

clash_project:clash

References

https://github.com/Fndroid/clash_for_windows_pkg/issues/3405
https://github.com/Fndroid/clash_for_windows_pkg/issues/3405

Check your stack JSON