CVE Intelligence
Analysis AI-assisted

CVE-2026-25130: CAI Framework OS Command Injection in find_file Tool

The CAI (Cybersecurity AI) framework, in versions up to and including 0.5.10, passes user-controlled input to shell commands through its function tools, which the record describes as OS command injection. According to the record, the find_file tool runs without user approval, which could let an attacker execute arbitrary commands on the host and bypass human-in-the-loop controls. A fix commit is referenced, but the record does not state a fixed release number.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

The record describes the CAI (Cybersecurity AI) framework, a framework for AI security, as containing argument injection vulnerabilities in its function tools. User-supplied input is reported to reach shell commands through subprocess.Popen with shell enabled. The project advisory is GHSA-jfpc-wj3m-qw2m.

Impact

  • The record states that an attacker could execute arbitrary commands on the host system.
  • The find_file tool runs without user approval because find is treated as a pre-approved safe command, which the record says bypasses human-in-the-loop safeguards.
  • The CNA assigned a CVSS 3.1 base score of 9.6 (critical), with high confidentiality, integrity and availability impact.

Affected products and versions

  • The record describes versions up to and including 0.5.10 as affected.
  • The structured affected list in the record is empty, so package names and exact version ranges beyond that statement are unknown.
  • No fixed version is stated. A fix commit is referenced: commit e22a1220.

Exploitation status

  • The CISA KEV catalog does not list this CVE in the data consulted.
  • No confirmed exploitation in the wild appears in the sources consulted. No EPSS data is available in the record.

Remediation and mitigation

  • Update CAI to a release that includes commit e22a1220f764e2d7cf9da6d6144926f53ca01cde. The record does not name the release, so confirm it against the project advisory.
  • Until updated, limit or disable the find_file tool and any other function tools that accept untrusted input.
  • Do not rely on command allowlists alone when arguments reach a shell. Prefer execution without a shell and strict argument handling.
  • Run agent processes with least privilege and in isolated environments.

Detection guidance

  • Review logs of tool invocations for unexpected argument patterns in file search tools.
  • Monitor for unexpected child processes started by the CAI runtime.
  • Audit approval policies to confirm which commands are pre-approved and whether that pre-approval is appropriate.

Limitations of the available information

  • The record gives no fixed version number and no complete list of affected packages.
  • No exploitation telemetry is available beyond the KEV and EPSS fields being empty.
  • The source status is Deferred. Verify details against the project advisory and the NVD entry.

Frequently asked questions

Which CAI versions does this CVE affect?

The record states that versions up to and including 0.5.10 are affected. The structured affected list in the record is empty, so the exact package and version boundaries should be confirmed in the project advisory.

Is there a fix available?

The record references a fix commit, e22a1220f764e2d7cf9da6d6144926f53ca01cde, but does not name a fixed release. Update to a release that includes that commit and verify with the vendor advisory.

Is this CVE known to be exploited in the wild?

The CISA KEV catalog does not list it in the data consulted, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.