Read the docs
TI-2026-20870 Aliases CVE-2026-25807

Unauthenticated Remote Code Execution via P2P Sharing in ZAI-Shell

Priority HIGH 73CWE-94Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-94.

Summary

ZAI Shell is an autonomous SysOps agent designed to navigate, repair, and secure complex environments. Prior to 9.0.3, the P2P terminal sharing feature (share start) opens a TCP socket on port 5757 without any authentication mechanism. Any remote attacker can connect to this port using a simple socket script. An attacker who connects to a ZAI-Shell P2P session running in --no-ai mode can send arbitrary system commands. If the host user approves the command without reviewing its contents, the command executes directly with the user's privileges, bypassing all Sentinel safety checks. This vulnerability is fixed in 9.0.3.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00714 53rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed zai-shell (TaklaXBR): 9.0.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
TaklaXBRzai-shellbefore 9.0.39.0.3Patch availableCNA
  • zai-shell VendorTaklaXBR Affected before 9.0.3 Fixed in 9.0.3 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:taklaxbr:zai_shell:*:*:*:*:*:python:*:*before 9.0.3VulnerableTaklaXBR
  • cpe:2.3:a:taklaxbr:zai_shell:*:*:*:*:*:python:*:* Versions before 9.0.3 Vulnerable ·TaklaXBR

Remediation

  • Fix · CNA zai-shell (TaklaXBR) Fixed in 9.0.3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-25807

References

Exploit 1

Patch 1

Other 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences