CVE-2026-90617 Details
Description
A vulnerability was detected in GH05TCREW PentestAgent up to cf882dabea3ed91cef016cdd115e5426315665a2. This vulnerability affects the function run_task of the file interface/main.py of the component MCP HTTP Server. Performing a manipulation results in os command injection. The attack is possible to be carried out remotely. The exploit is now public and may be used. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The pull request to fix this issue awaits acceptance.
A vulnerability allowing OS command injection has been identified in GH05TCREW PentestAgent versions prior to the commit cf882dabea3ed91cef016cdd115e5426315665a2. The issue arises in the MCP HTTP server component, specifically within the 'run_task' function of 'interface/main.py'. This vulnerability can be exploited remotely, as the server binds to '0.0.0.0:8080' by default, without authentication or access controls. The flaw allows an attacker to execute arbitrary shell commands on the host machine via the 'LocalRuntime', which lacks sandboxing.
Users are advised to update to a version that includes the authentication middleware and changes the default bind address to '127.0.0.1'.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 14, 2026CISA-ADP
Assessed Sep 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/GH05TCREW/pentestagent/ | [email protected] | Source CodeVendor |
| https://github.com/GH05TCREW/pentestagent/issues/90 | [email protected] | ExploitIssue TrackingTechnical AnalysisVendor |
| https://github.com/GH05TCREW/pentestagent/pull/101 | [email protected] | Issue TrackingVendor |
| https://vuldb.com/cve/CVE-2026-90617 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/914808 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/403198 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/403198/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-77 | Improper Neutralization of Special Elements used in a Command ('Command Injection') | [email protected] |
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| GH05TCREW PentestAgent | <= cf882dabea3ed91cef016cdd115e5426315665a2 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 15, 2026 | CVE Modified | CISA-ADP |
| Sep 14, 2026 | New CVE Received | [email protected] |