CVE-2026-90621
ipa-lab HackingBuddyGPT ssh_run_command.py ssh_run_command os command injection
- State
- Published
- Severity
- 5.3 Medium
- Published
- Sep 14, 2026
- Updated
- Sep 15, 2026
- Reserved
- Sep 12, 2026
Description
A vulnerability was identified in ipa-lab HackingBuddyGPT up to 0.5.0. This affects the function ssh_run_command of the file src/hackingBuddyGPT/extensions/ssh_run_command.py. Such manipulation leads to os command injection. The attack can be launched remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 6.3 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 3.0 | 6.3 Medium | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 2.0 | 6.5 Medium | AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR | VulDB |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
HackingBuddyGPTipa-lab |
|
References
- VDB-403203 | ipa-lab HackingBuddyGPT ssh_run_command.py ssh_run_command os command injectionvdb-entrytechnical-description
- VDB-403203 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
- CVE-2026-90621 | CVE Analysis and Reportthird-party-advisory
- Submit #914814 | ipa-lab hackingBuddyGPT v1.0 RCEthird-party-advisory
- https://github.com/ipa-lab/hackingBuddyGPT/issues/150exploitissue-tracking
- https://github.com/ipa-lab/hackingBuddyGPT/product
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.