CVE-2022-40126: Clash Project Clash

High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days.

A misconfiguration in the Service Mode profile directory of Clash for Windows v0.19.9 allows attackers to escalate privileges and execute arbitrary commands when Service Mode is activated.

Affected products

• Clash Project Clash: version 0.19.9 only

Published 2022-09-29. Last modified 2026-06-17.