An issue in Ntfy ntfy.sh before v.2.21 allows a remote attacker to execute arbitrary code via the parseActions function

A critical vulnerability (CVE-2026-39087) has been identified in Ntfy ntfy.sh versions prior to v.2.21. The vulnerability exists in the parseActions function and allows remote attackers to execute arbitrary code. This represents a high-severity security flaw that could enable complete system compromise through remote code execution. Organizations using affected versions of Ntfy should immediately update to version 2.21 or later to mitigate this risk.