CVE-2026-90618 Details
Description
A flaw has been found in GH05TCREW PentestAgent up to cf882dabea3ed91cef016cdd115e5426315665a2. This issue affects the function LocalRuntime.execute_command of the file runtime/runtime.py of the component LocalRuntime. Executing a manipulation can lead to os command injection. The attack may be performed from remote. The exploit has been published and may be used. The pull request to fix this issue awaits acceptance.
A command injection vulnerability has been identified in GH05TCREW PentestAgent versions prior to commit cf882dabea3ed91cef016cdd115e5426315665a2. The issue resides in the LocalRuntime component, specifically within the execute_command function of runtime/runtime.py. This vulnerability allows for arbitrary OS command execution, potentially exploitable from a remote location. The flaw arises because the LocalRuntime executes commands generated by the LLM agent without any validation, sandboxing, or isolation from the filesystem, running them directly on the host machine.
Users are advised to switch the default runtime to DockerRuntime, which offers better isolation, and to implement command validation in the LocalRuntime.execute_command function. Additionally, running LocalRuntime in a restricted environment with network and filesystem limitations can help mitigate the risk.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 14, 2026CISA-ADP
Assessed Sep 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/GH05TCREW/pentestagent/ | [email protected] | Source CodeVendor |
| https://github.com/GH05TCREW/pentestagent/issues/91 | [email protected] | ExploitIssue TrackingTechnical AnalysisVendor |
| https://github.com/GH05TCREW/pentestagent/pull/100 | [email protected] | Issue TrackingVendor |
| https://vuldb.com/cve/CVE-2026-90618 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/914809 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/403199 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/403199/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-77 | Improper Neutralization of Special Elements used in a Command ('Command Injection') | [email protected] |
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| GH05TCREW PentestAgent | <= cf882dabea3ed91cef016cdd115e5426315665a2 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 14, 2026 | CVE Modified | CISA-ADP |
| Sep 14, 2026 | New CVE Received | [email protected] |