Cybersecurity AI vulnerable to command Injection through argument injection in find_file Agent tool
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-78.
Summary
Cybersecurity AI (CAI) is a framework for AI Security. In versions up to and including 0.5.10, the CAI (Cybersecurity AI) framework contains multiple argument injection vulnerabilities in its function tools. User-controlled input is passed directly to shell commands via `subprocess.Popen()` with `shell=True`, allowing attackers to execute arbitrary commands on the host system. The `find_file()` tool executes without requiring user approval because find is considered a "safe" pre-approved command. This means an attacker can achieve Remote Code Execution (RCE) by injecting malicious arguments (like -exec) into the args parameter, completely bypassing any human-in-the-loop safety mechanisms. Commit e22a1220f764e2d7cf9da6d6144926f53ca01cde contains a fix.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| aliasrobotics | cai | up to 0.5.10 | — | No fix listed | CNA |
| — | cai-framework (PyPI) | up to 0.5.10 | — | No fix listed | GHSA-jfpc-wj3m-qw2m |
- cai Vendoraliasrobotics Affected up to 0.5.10 Fixed in — No fix listed CNA
- cai-framework (PyPI) Vendor— Affected up to 0.5.10 Fixed in — No fix listed GHSA-jfpc-wj3m-qw2m
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2026-25130
- 2026-10-03 Alias added: GHSA-jfpc-wj3m-qw2m
References
Other 6
- https://github.com/aliasrobotics/cai/security/advisories/GHSA-jfpc-wj3m-qw2m
- https://github.com/aliasrobotics/cai/commit/e22a1220f764e2d7cf9da6d6144926f53ca01cde
- https://github.com/aliasrobotics/cai/blob/559de8fcbc2b44f3b0360f35ffdc2bb975e7d7e4/src/cai/tools/reconnaissance/filesystem.py#L60
- https://github.com/aliasrobotics/cai
- https://github.com/pypa/advisory-database/tree/main/vulns/cai-framework/PYSEC-2026-303.yaml
- https://pypi.org/project/cai-framework
More aliasrobotics vulnerabilities
- TI-2025-41267 Cybersecurity AI (CAI) vulnerable to Command Injection in run_ssh_command_with_credentials Agent tool CVSS 3.1CRITICAL 9.7
- TI-2020-08279 RVD#2554: MiR ROS computational graph presents no authentication mechanisms CVSS 3.1CRITICAL 9.8
- TI-2020-08278 Exposure of resource to wrong sphere in Mobile Industrial Robots A/S MiR100 CVSS 3.1CRITICAL 9.8
- TI-2020-08277 RVD#2557: Hardcoded Credentials on MiRX00 Control Dashboard CVSS 3.1CRITICAL 9.8
- TI-2020-08276 RVD#2566: Hardcoded Credentials on MiRX00 wireless Access Point CVSS 3.1CRITICAL 9.8
- TI-2020-08286 RVD#2569: Insecure operating system defaults in MiR robots CVSS 3.1CRITICAL 9.8
Sources
- CVE-2026-25130 · CVE Program
- CVE-2026-25130 · NVD
- FIRST EPSS
- GHSA-jfpc-wj3m-qw2m · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences