CVE-2026-30352 Details
Description
A remote code execution (RCE) vulnerability in the /devserver/start endpoint of leonvanzyl autocoder commit 79d02a allows attackers to execute arbitrary code via providing a crafted command parameter.
A remote code execution vulnerability has been identified in the Leonvanzyl Autocoder project, specifically in commit 79d02a. The issue arises in the '/devserver/start' endpoint, where attackers can execute arbitrary code by sending a crafted command parameter. This vulnerability is part of the Autocoder application, which is designed to automate coding tasks using an AI agent.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Apr 27, 2026CISA-ADP
Assessed Apr 27, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://gist.github.com/syphonetic/e3bdee6c022b36d5ecb98fbf61284931 | [email protected] | Technical Description |
| https://github.com/leonvanzyl/autocoder | [email protected] |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-77 | Improper Neutralization of Special Elements used in a Command ('Command Injection') | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| leonvanzyl autocoder | All versions |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 5, 2026 | CVE Modified | [email protected] |
| Jul 5, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 27, 2026 | New CVE Received | [email protected] |
| Apr 27, 2026 | CVE Modified | CISA-ADP |