Is CVE-2026-19332 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-19332?

CVE-2026-19332 has a CVSS v3 severity of MEDIUM (5.3).

Back

CVE-2026-19332

Description

A security vulnerability has been detected in NellyW8 MCP4EDA 1.0.0. Affected by this vulnerability is an unknown functionality of the component run_openlane/view_waveform. The manipulation of the argument design_name/vcd_file leads to command injection. Local access is required to approach this attack. The project was informed of the problem early through an issue report but has not responded yet.