It affects versions through 2.0.19 and involves an uncontrolled library search path.An unauthenticated remote attacker may redirect library access and execute arbitrary code. The Mandiant CNA assigns a CVSS 4.0 score of 9.3 Critical.
What it allows
How Does CVE-2026-104989 Affect V-Ray?
The package upload feature searches for libraries through a path that can include attacker-controlled locations. This CWE-427 condition lets an unintended party influence which library the application loads.
The public record says a remote attacker can redirect library access without authentication. If the application loads the redirected library, attacker-controlled code may run in the vulnerable system.
The CVSS 4.0 vector is AV:N/AC:L/AT:N/PR:N/UI:N. It rates confidentiality, integrity, and availability impacts as high on the vulnerable system.
Who is affected
The GitHub advisory and NVD description identify Chaos Software V-Ray versions through 2.0.19 as affected. NVD had not yet analyzed product configurations when the source pack was fetched on November 9, 2026.
The vendor reference available in the source pack is titled 2.0.21, but its captured text does not state a fixed version. Administrators should confirm supported upgrade guidance with Chaos Software before deployment.
What to do
-
Inventory V-Ray versions through 2.0.19
Identify every V-Ray deployment at version 2.0.19 or earlier. Prioritize systems whose package upload feature is reachable from untrusted networks.
-
Confirm the supported upgrade with Chaos Software
Use current Chaos Software guidance to select a supported release. The captured vendor page does not provide enough text to verify a specific fixed version.
-
Restrict access to package upload workflows
Brandefense recommends limiting package uploads to trusted administration paths while remediation is underway. Remove unnecessary exposure and apply existing network controls.
-
Review library-loading and process activity
Brandefense recommends checking application, process, and library-loading telemetry for unexpected behavior. Preserve evidence and follow the incident response plan when anomalies appear.
What Brandefense can do
- Scan your domain in Brandefense Atlas, free
Atlas checks public sources for leaked credentials, phishing domains, dark web mentions and data sales, then gives your domain a risk grade. Free, no sign-up.
- Vulnerability Intelligence
Brandefense Vulnerability Intelligence follows which vulnerabilities attackers are using, so your team can patch what is under attack first.
Frequently Asked Questions
What is CVE-2026-104989?
It is a critical uncontrolled search path vulnerability in the Chaos Software V-Ray package upload feature. It may allow unauthenticated remote code execution.
Which V-Ray versions are affected by CVE-2026-104989?
The GitHub advisory and NVD description identify Chaos Software V-Ray versions through 2.0.19 as affected.
Does CVE-2026-104989 require authentication or user interaction?
No. The CVSS 4.0 vector records no privileges and no user interaction. The attack vector is network-based.
What is the severity of CVE-2026-104989?
The Mandiant CNA assigns CVSS 4.0 9.3 Critical. The public GitHub advisory and NVD record do not provide a CVSS 3.1 score.
Sources
- GitHub Advisory GHSA-g9j4-q8h4-63pxGitHub
- NVD: CVE-2026-104989NIST NVD
- Chaos Software V-Ray 2.0.21 Documentationdocumentation.chaos.com
