# Szafir SDK Web flaws enable arbitrary code execution

Published: 2026-04-02 · Severity: high
Canonical: https://vorant.io/reports/8f56ccbd-17c0-5d22-8357-92b55b2207ba/szafir-sdk-web-flaws-enable-arbitrary-code-execution

> Two vulnerabilities in Szafir SDK Web allow attackers to execute arbitrary code by launching the SzafirHost application with malicious parameters and loading unverified libraries.

CERT Polska coordinated disclosure of two vulnerabilities in Szafir SDK Web, a browser plug-in that launches the SzafirHost application. CVE-2026-26927 allows an unauthenticated attacker to craft a malicious website that can launch SzafirHost with arbitrary arguments by manipulating the document_base_url parameter. The application fails to validate whether the specified URL relates to the actual calling web application, potentially tricking users into executing the application in an attacker-controlled context. If a victim has previously accepted execution with the 'remember' option, no prompt is shown and the attack proceeds silently.

CVE-2026-26928 affects SzafirHost's library update mechanism. While the application properly verifies JAR files using trusted hashes and digital signatures, it fails to perform equivalent validation for DLL, SO, JNILIB, or DYLIB files. An attacker can supply malicious libraries that will be saved to the user's temp folder and executed by the application without verification. CVE-2026-26927 was addressed in Szafir SDK Web version 0.0.17.4, while CVE-2026-26928 was fixed in SzafirHost version 1.1.0.

The vulnerabilities were responsibly disclosed by Michał Leszczyński. Organizations using Szafir SDK Web should update immediately to the patched versions to prevent potential code execution attacks.

## Mentioned in this report

- Vulnerabilities: CVE-2026-26927, CVE-2026-26928

## Detection guidance (public sample)

### SzafirHost Launched with document_base_url Parameter (Possible CVE-2026-26927 Exploitation)

ATT&CK: T1204.002

Detects SzafirHost.exe invoked with a document_base_url argument, which can be manipulated by a malicious website to launch the application in an attacker-controlled context and bypass the origin-verification prompt. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: SzafirHost Launched with document_base_url Parameter
id: d4ef056a-0662-536f-bfe3-e02dab694499
status: experimental
description: Detects SzafirHost.exe being launched (typically by a browser process)
  with a document_base_url command-line argument, which CVE-2026-26927 allows a malicious
  website to spoof, potentially triggering silent execution if the user previously
  chose 'remember'.
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: \\SzafirHost.exe
    CommandLine|contains: document_base_url
  filter:
    ParentImage|endswith:
    - \\SzafirHost.exe
  condition: selection and not filter
falsepositives:
- Legitimate trusted web applications invoking Szafir SDK Web with a valid document_base_url
  matching the calling site (expected on unpatched versions prior to 0.0.17.4)
level: medium
tags:
- attack.t1204.002
author: Vorant
```

### SzafirHost Dropping Unsigned Native Library to Temp Folder

ATT&CK: T1055.001

Detects SzafirHost.exe writing DLL, SO, JNILIB, or DYLIB files to the user's temp directory, matching the CVE-2026-26928 library update mechanism that lacks signature/hash validation for native libraries (unlike JAR files). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: SzafirHost Dropping Unsigned Native Library to Temp Folder
id: 0b079eca-253c-5a3e-a53f-b2be60a458da
status: experimental
description: Detects SzafirHost.exe creating library files (.dll, .so, .jnilib, .dylib)
  in a temp directory, consistent with the CVE-2026-26928 update mechanism that fails
  to validate native libraries via hash/signature checks, allowing malicious code
  to be staged for execution.
logsource:
  category: file_event
  product: windows
detection:
  selection:
    Image|endswith: \\SzafirHost.exe
    TargetFilename|contains: \\Temp\\
    TargetFilename|endswith:
    - .dll
    - .so
    - .jnilib
    - .dylib
  condition: selection
falsepositives:
- Legitimate SzafirHost library update flow on unpatched versions performing routine
  component updates
level: medium
tags:
- attack.t1055.001
author: Vorant
```

### SzafirHost Loading Native Library from Temp Directory

ATT&CK: T1055.001

Detects SzafirHost.exe loading a DLL/SO/JNILIB/DYLIB image directly from a temp folder, indicating execution of an unverified native library possibly delivered via CVE-2026-26928. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: SzafirHost Loading Native Library from Temp Directory
id: b07444ca-e010-59e2-8830-5053b55e54dc
status: experimental
description: Detects SzafirHost.exe loading a native library image (DLL/SO/JNILIB/DYLIB)
  from a temp directory path, which reflects execution of an unsigned/unverified library
  staged via the vulnerable update mechanism (CVE-2026-26928).
logsource:
  category: image_load
  product: windows
detection:
  selection:
    Image|endswith: \\SzafirHost.exe
    ImageLoaded|contains: \\Temp\\
    ImageLoaded|endswith: .dll
  condition: selection
falsepositives:
- Legitimate SzafirHost update process loading a newly fetched library from temp on
  unpatched versions before restart/relocation
level: medium
tags:
- attack.t1055.001
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://cert.pl/en/posts/2026/04/CVE-2026-26927

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/8f56ccbd-17c0-5d22-8357-92b55b2207ba/szafir-sdk-web-flaws-enable-arbitrary-code-execution.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup