CVE-2026-100230 input-leap CVE debrief

Who should care

Defenders responsible for Input Leap installations, especially those using the --enable-drag-drop option, should assess exposure and verify versions. They should also review compensating controls for exposed systems, check relevant monitoring, detection, and logs for exposed assets, and track exceptions, retest remediated assets. Prioritization should be given to verifying Input Leap versions and configurations to prevent potential code execution.

Why it matters

CVE-2026-100230 is a directory traversal vulnerability in Input Leap that can lead to code execution if exploited. Defenders should prioritize verifying Input Leap versions and configurations, especially those using the --enable-drag-drop option.

• Verify Input Leap versions and configurations to prevent potential code execution
• Assess exposure of Input Leap installations using the --enable-drag-drop option
• Monitor for suspicious activity related to directory traversal

Technical summary

Input Leap through 3.0.3, when the non-default --enable-drag-drop option is used on Windows or macOS, mishandles the / versus distinction and allows directory traversal, with resultant code execution if a file is written to a startup directory. This occurs via a DDRG message. The vulnerability has a CVSS score of 5.3 and a severity of MEDIUM. Defenders should prioritize verifying Input Leap versions and configurations, especially those using the --enable-drag-drop option, and assess exposure to prevent potential code execution.

Defensive priority

Defenders should prioritize verifying Input Leap versions and configurations, especially those using the --enable-drag-drop option.

Recommended defensive actions

• Verify Input Leap versions and configurations
• Disable --enable-drag-drop option if not required
• Monitor for suspicious activity
• Review compensating controls for exposed systems
• Check relevant monitoring, detection, and logs for exposed assets
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is caused by mishandling of the / versus distinction in Input Leap's Drag and Drop functionality. This mishandling allows directory traversal, which can lead to code execution if a file is written to a startup directory. The vulnerability has been reported in Input Leap through version 3.0.3. Official CVE Program record and NIST NVD detail page provide additional information.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.