CVE-2026-90621
A vulnerability was identified in ipa-lab HackingBuddyGPT up to 0.5.0. This affects the function ssh_run_command of the file src/hackingBuddyGPT/extensions/ssh_run_command.py. Such manipulation leads to os command injection. The attack can be launched remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 6.5
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
- EPSS probability
- 1.09%
- CWE
- CWE-78, CWE-77
- Published
- 2026-09-14
- Last modified
- 2026-09-15
Affected products
- ipa-lab HackingBuddyGPT
- ipa-lab HackingBuddyGPT
- ipa-lab HackingBuddyGPT
- ipa-lab HackingBuddyGPT
- ipa-lab HackingBuddyGPT
Weakness type
Related vulnerabilities
- CVE-2026-83549 — Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerabi
- CVE-2026-86152 — Tenda CP3 Kylin AutoAddWifi.cpp ThreadProc os command injection
- CVE-2026-82004 — Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
- CVE-2026-79724 — Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards
- CVE-2026-90822 — FatPipe MPVPN, WARP, and IPVPN appliances running the end-of-life firmware version 10.1.2r60p100 contain an OS command i
- CVE-2026-81467 — Dell ThinOS 10, versions prior to 2605_10. 2616, contains an Improper Neutralization of Special Elements used in an OS C
- CVE-2026-71376 — OS Command Injection Vulnerability in Cosminexus Component Container
- CVE-2026-57124 — PraisonAI UI MCP connect endpoint allows unauthenticated local command execution