CVE-2022-26255: Clash Project Clash

Critical severity, CVSS 9.8. EPSS: 1.8% chance of exploitation in the next 30 days.

Clash for Windows v0.19.8 was discovered to allow arbitrary code execution via a crafted payload injected into the Proxies name column.

Affected products

• Clash Project Clash: version 0.19.8 only

Published 2022-03-28. Last modified 2026-06-17.