High
Agentic-Flow: OS Command Injection in agentic-flow MCP server tools via unsanitized tool-parameter interpolation into execSync
Type: advisorySources: OSV
Agentic-Flow is an AI agent orchestration platform. Prior to 2.0.14, agentic-flow MCP server tools in src/mcp/standalone-stdio.ts, src/mcp/fastmcp/servers/claude-flow-sdk.ts, src/mcp/fastmcp/servers/stdio-full.ts, src/mcp/fastmcp/servers/http-streaming-updated.ts, src/mcp/fastmcp/servers/http-sse.ts, src/mcp/fastmcp/servers/poc-stdio.ts, src/mcp/fastmcp/tools/agent/{execute,list,parallel}.ts, src/mcp/fastmcp/tools/swarm/orchestrate.ts, and src/mcp/fastmcp/tools/hooks/pretrain.ts interpolated attacker-influenceable tool parameters such as agent, task, name, language, and agentdb directly into shell command strings passed to execSync(), allowing arbitrary OS command execution with the privileges of the MCP server user. This issue is fixed in version 2.0.14.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-58195
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 7 Nov 2026, 21:17 UTC · Revision 1
Source evidence
Agentic-Flow: OS Command Injection in agentic-flow MCP server tools via unsanitized tool-parameter interpolation into execSync
core-osv · Original sourcePublished 17 Jul 2026, 18:47 UTC
Agentic-Flow is an AI agent orchestration platform. Prior to 2.0.14, agentic-flow MCP server tools in src/mcp/standalone-stdio.ts, src/mcp/fastmcp/servers/claude-flow-sdk.ts, src/mcp/fastmcp/servers/stdio-full.ts, src/mcp/fastmcp/servers/http-streaming-updated.ts, src/mcp/fastmcp/servers/http-sse.ts, src/mcp/fastmcp/servers/poc-stdio.ts, src/mcp/fastmcp/tools/agent/{execute,list,parallel}.ts, src/mcp/fastmcp/tools/swarm/orchestrate.ts, and src/mcp/fastmcp/tools/hooks/pretrain.ts interpolated attacker-influenceable tool parameters such as agent, task, name, language, and agentdb directly into shell command strings passed to execSync(), allowing arbitrary OS command execution with the privileges of the MCP server user. This issue is fixed in version 2.0.14.
osv:CVE-2026-58195
Complete source record
{
"id": "07ed0be05579da63b8193a332338f63a6a35ede51ae625f10b7cbae70542cf7f",
"url": "https://osv.dev/vulnerability/CVE-2026-58195",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Agentic-Flow: OS Command Injection in agentic-flow MCP server tools via unsanitized tool-parameter interpolation into execSync",
"summary": "Agentic-Flow is an AI agent orchestration platform. Prior to 2.0.14, agentic-flow MCP server tools in src/mcp/standalone-stdio.ts, src/mcp/fastmcp/servers/claude-flow-sdk.ts, src/mcp/fastmcp/servers/stdio-full.ts, src/mcp/fastmcp/servers/http-streaming-updated.ts, src/mcp/fastmcp/servers/http-sse.ts, src/mcp/fastmcp/servers/poc-stdio.ts, src/mcp/fastmcp/tools/agent/{execute,list,parallel}.ts, src/mcp/fastmcp/tools/swarm/orchestrate.ts, and src/mcp/fastmcp/tools/hooks/pretrain.ts interpolated attacker-influenceable tool parameters such as agent, task, name, language, and agentdb directly into shell command strings passed to execSync(), allowing arbitrary OS command execution with the privileges of the MCP server user. This issue is fixed in version 2.0.14.",
"evidence": "osv:CVE-2026-58195",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2026-58195",
"aliases": [
"CVE-2026-58195",
"GHSA-vcv2-r9jh-99m5"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/ruvnet/agentic-flow",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "0c2ec967736a8b6b85832c6bae2a3e74989705ec"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"fixed": "0c2ec967736a8b6b85832c6bae2a3e74989705ec"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
},
{
"repo": "https://github.com/ruvnet/ruflo",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "da901d06cc5661ebf3f66a962dc116464e7980b0"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"fixed": "da901d06cc5661ebf3f66a962dc116464e7980b0"
}
],
"source": "REFERENCES_TAG",
"original_tag": "v3.12.4"
}
]
}
}
],
"versions": [
"v2.3.6",
"agentic-jujutsu-v2.3.6",
"v2.3.5",
"v2.3.4",
"v2.3.3",
"v2.3.2",
"v2.3.1",
"v2.2.0",
"v2.1.1",
"v2.1.0",
"v2.0.3",
"v2.0.2",
"v2.0.1",
"v2.0.0",
"v1.10.0",
"agentdb-v1.0.0",
"v1.2.7",
"v3.12.3",
"v3.12.2",
"v3.12.1",
"v3.12.0",
"v3.11.0",
"v3.10.46",
"v3.10.45",
"v3.10.44",
"v3.10.43",
"v3.10.42",
"v3.10.41",
"v3.10.40",
"v3.10.39",
"v3.10.38",
"v3.10.34",
"v3.10.33",
"v3.10.31",
"v3.10.30",
"v3.10.29",
"v3.10.28",
"v3.10.27",
"v3.10.26",
"v3.10.25",
"v3.10.24",
"v3.10.23",
"v3.10.22",
"v3.10.21",
"v3.10.20",
"v3.10.19",
"v3.10.18",
"v3.10.17",
"v3.10.16",
"v3.10.15",
"v3.10.14",
"v3.10.13",
"v3.10.12",
"v3.10.11",
"v3.10.10",
"v3.10.9",
"v3.10.8",
"v3.10.7",
"v3.10.6",
"v3.10.5",
"v3.10.4",
"v3.10.2",
"v3.10.0",
"v3.8.0",
"v3.7.0",
"v3.7.0-alpha.76",
"v3.7.0-alpha.71",
"v3.7.0-alpha.70",
"v3.7.0-alpha.44",
"v3.7.0-alpha.42",
"v3.7.0-alpha.41",
"v3.7.0-alpha.33",
"v3.7.0-alpha.23",
"v3.7.0-alpha.22",
"v3.7.0-alpha.8",
"v3.7.0-alpha.3",
"v3.7.0-alpha.1",
"v3.6.30",
"v3.6.28",
"v3.6.27",
"v3.6.26",
"v3.6.25",
"v3.6.10",
"v3.5.80",
"v3.5.78",
"v3.5.51",
"v3.5.50",
"v3.5.49",
"v3.5.48",
"v3.5.31",
"v3.5.15",
"v3.5.7",
"v3.5.4",
"v3.5.3",
"v3.0.0-alpha.79",
"v2.7.0-alpha.1",
"v2.7.0-alpha",
"task-20250926-192626",
"session-session-20250926-192641",
"session-session-20250926-191759",
"v2.0.0-alpha.128",
"task-20250926-191506",
"task-20250926-190837",
"task-20250926-184019",
"task-20250926-180218",
"task-20250926-180100",
"task-20250926-175544",
"task-20250926-175312",
"task-20250926-174709",
"task-20250926-174312",
"task-20250926-173944",
"task-20250926-172956",
"task-20250926-170749",
"task-20250926-170628",
"task-20250926-164810",
"session-session-20250926-191241",
"session-session-20250926-184515",
"session-session-20250926-180737",
"session-session-20250926-175950",
"session-session-20250926-175458",
"session-session-20250926-175225",
"session-session-20250926-174627",
"session-session-20250926-173942",
"session-session-20250926-171226",
"session-session-20250926-170658",
"session-session-20250926-164859",
"task-20250926-154834",
"task-20250926-154156",
"task-20250926-153920",
"task-20250926-153703",
"task-20250926-153446",
"task-20250926-152745",
"task-20250926-152258",
"task-20250926-151416",
"task-20250926-151030",
"task-20250926-150902",
"task-20250926-150552",
"task-20250926-150140",
"task-20250926-145927",
"task-20250926-145131",
"task-20250926-145102",
"task-20250926-144936",
"task-20250926-144408",
"task-20250926-144257",
"task-20250926-144139",
"task-20250926-144032",
"task-20250926-143721",
"task-20250918-223546",
"session-session-20250926-155158",
"session-session-20250926-154555",
"session-session-20250926-154149",
"session-session-20250926-153814",
"session-session-20250926-153547",
"session-session-20250926-153346",
"session-session-20250926-152653",
"session-session-20250926-152222",
"session-session-20250926-151258",
"session-session-20250926-151227",
"session-session-20250926-150830",
"session-session-20250926-150406",
"session-session-20250926-145336",
"session-session-20250926-144731",
"session-session-20250926-144404",
"session-session-20250926-143850",
"session-session-20250918-223558",
"session-session-20250918-222708",
"task-20250918-222602",
"task-20250918-222156",
"session-session-20250918-222457",
"session-session-20250918-221953",
"task-20250918-215637",
"task-20250918-215531",
"task-20250918-215340",
"task-20250918-215257",
"task-20250918-215136",
"session-session-20250918-215525",
"session-session-20250918-215203",
"session-session-20250918-215119",
"task-20250918-214833",
"task-20250918-214814",
"task-20250918-214709",
"task-20250918-214650",
"session-session-20250918-214659",
"task-20250918-214538",
"task-20250918-214512",
"session-session-20250918-214356",
"task-20250918-214228",
"task-20250918-213926",
"task-20250918-213733",
"task-20250918-213112",
"task-20250918-212728",
"task-20250918-212024",
"task-20250918-210945",
"task-20250918-210932",
"task-20250918-210813",
"task-20250918-203920",
"task-20250918-203757",
"task-20250918-203546",
"task-20250918-202720",
"task-20250918-194806",
"task-20250918-194719",
"task-20250918-194708",
"task-20250918-194629",
"task-20250918-194616",
"task-20250918-194602",
"task-20250918-194547",
"task-20250918-194418",
"task-20250918-193743",
"task-20250918-193228",
"task-20250918-192835",
"task-20250918-192638",
"task-20250918-192527",
"task-20250918-191917",
"task-20250918-191456",
"task-20250918-191106",
"task-20250918-190958",
"task-20250918-190719",
"task-20250918-190559",
"task-20250918-190415",
"task-20250918-184717",
"task-20250918-184410",
"task-20250918-184101",
"task-20250918-183713",
"task-20250918-175239",
"task-20250918-175122",
"task-20250918-174642",
"task-20250918-174442",
"task-20250911-030721",
"task-20250910-183412",
"task-20250910-182217",
"task-20250910-182141",
"task-20250910-181541",
"task-20250910-181041",
"task-20250910-180956",
"task-20250910-180827",
"task-20250910-180748",
"task-20250910-174942",
"task-20250910-174846",
"task-20250910-174742",
"task-20250910-174539",
"task-20250910-174512",
"task-20250910-174234",
"task-20250910-174217",
"task-20250910-173554",
"task-20250910-173355",
"task-20250910-173254",
"task-20250910-173049",
"task-20250910-172910",
"task-20250910-172720",
"task-20250910-171603",
"task-20250910-170943",
"task-20250910-170731",
"task-20250910-170336",
"task-20250910-165805",
"task-20250910-165524",
"task-20250910-165212",
"task-20250910-165002",
"task-20250910-164632",
"task-20250910-164408",
"task-20250910-162559",
"task-20250910-161857",
"task-20250910-133820",
"task-20250910-133416",
"task-20250910-133236",
"task-20250910-132905",
"task-20250910-132529",
"task-20250910-132443",
"task-20250910-132359",
"task-20250910-131630",
"session-session-20250918-214154",
"session-session-20250918-213647",
"session-session-20250918-212542",
"session-session-20250918-212008",
"session-session-20250918-202909",
"session-session-20250918-195635",
"session-session-20250918-194619",
"session-session-20250918-194606",
"session-session-20250918-194523",
"session-session-20250918-194300",
"session-session-20250918-193420",
"session-session-20250918-193031",
"session-session-20250918-192720",
"session-session-20250918-192601",
"session-session-20250918-192008",
"session-session-20250918-191727",
"session-session-20250918-190853",
"session-session-20250918-190620",
"session-session-20250918-190438",
"session-session-20250918-184922",
"session-session-20250918-184525",
"session-session-20250918-183851",
"session-session-20250918-175422",
"session-session-20250918-175220",
"session-session-20250918-174756",
"session-session-20250918-174604",
"session-session-20250910-183751",
"session-session-20250910-181825",
"session-session-20250910-180955",
"session-session-20250910-175506",
"session-session-20250910-174923",
"session-session-20250910-174807",
"session-session-20250910-174654",
"session-session-20250910-173852",
"session-session-20250910-173449",
"session-session-20250910-173319",
"session-session-20250910-173212",
"session-session-20250910-172950",
"session-session-20250910-171813",
"session-session-20250910-171246",
"session-session-20250910-170902",
"session-session-20250910-170504",
"session-session-20250910-170148",
"session-session-20250910-165653",
"session-session-20250910-165140",
"session-session-20250910-164935",
"session-session-20250910-134317",
"session-session-20250910-133719",
"session-session-20250910-133410",
"session-session-20250910-132450",
"task-20250907-051627",
"task-20250907-020140",
"task-20250907-015517",
"task-20250907-015438",
"task-20250907-014909",
"task-20250907-014315",
"task-20250907-013403",
"task-20250907-013351",
"session-session-20250907-051655",
"session-session-20250907-032427",
"session-session-20250907-020019",
"session-session-20250907-013053",
"task-20250907-012900",
"task-20250907-012630",
"task-20250906-233419",
"task-20250906-232723",
"task-20250906-232556",
"task-20250906-224812",
"task-20250906-222500",
"task-20250906-222403",
"task-20250906-214055",
"task-20250906-213810",
"task-20250906-212810",
"task-20250906-212707",
"task-20250906-212243",
"task-20250906-210358",
"task-20250906-204652",
"task-20250906-204235",
"task-20250906-204018",
"task-20250906-203359",
"task-20250906-202802",
"task-20250906-202608",
"task-20250906-202500",
"task-20250906-202233",
"task-20250906-201855",
"task-20250906-201136",
"task-20250904-145700",
"task-20250902-185952",
"task-20250829-140612",
"task-20250829-135747",
"task-20250829-135737",
"task-20250829-135707",
"task-20250829-135518",
"task-20250829-135458",
"task-20250829-134908",
"task-20250829-134826",
"task-20250829-134347",
"task-20250829-134201",
"task-20250829-133913",
"task-20250829-133557",
"task-20250826-183210",
"task-20250826-182941",
"task-20250826-182243",
"task-20250826-181730",
"task-20250826-181543",
"task-20250826-181429",
"task-20250826-180052",
"task-20250826-175632",
"task-20250826-175501",
"task-20250826-175032",
"task-20250826-170018",
"task-20250826-165135",
"task-20250826-164438",
"task-20250826-163634",
"task-20250826-163548",
"task-20250826-163142",
"task-20250826-161915",
"task-20250826-160441",
"task-20250826-155547",
"task-20250826-155440",
"task-20250826-154823",
"task-20250826-145817",
"task-20250826-144050",
"task-20250826-142715",
"task-20250826-142009",
"task-20250826-141904",
"task-20250826-141837",
"task-20250826-140933",
"task-20250821-193341",
"task-20250821-192403",
"task-20250821-191212",
"task-20250821-190418",
"task-20250821-185954",
"task-20250821-184221",
"task-20250821-183436",
"task-20250821-182849",
"task-20250821-182711",
"task-20250821-182313",
"task-20250816-171319",
"task-20250816-171001",
"task-20250816-170914",
"task-20250816-170847",
"session-session-20250906-234236",
"session-session-20250906-233055",
"session-session-20250906-224835",
"session-session-20250906-222918",
"session-session-20250906-222413",
"session-session-20250906-214531",
"session-session-20250906-212621",
"session-session-20250906-210736",
"session-session-20250906-204445",
"session-session-20250906-204215",
"session-session-20250906-203037",
"session-session-20250906-202622",
"session-session-20250906-202218",
"session-session-20250906-201748",
"session-session-20250904-150003",
"session-session-20250902-190126",
"session-session-20250829-140733",
"session-session-20250829-140629",
"session-session-20250829-135902",
"session-session-20250829-135754",
"session-session-20250829-135640",
"session-session-20250829-135402",
"session-session-20250829-134858",
"session-session-20250829-134400",
"session-session-20250829-134121",
"session-session-20250829-133605",
"session-session-20250826-183232",
"session-session-20250826-183200",
"session-session-20250826-182618",
"session-session-20250826-182235",
"session-session-20250826-181633",
"session-session-20250826-181530",
"session-session-20250826-180554",
"session-session-20250826-175743",
"session-session-20250826-175609",
"session-session-20250826-175112",
"session-session-20250826-170402",
"session-session-20250826-165852",
"session-session-20250826-164827",
"session-session-20250826-164413",
"session-session-20250826-163514",
"session-session-20250826-163030",
"session-session-20250826-161255",
"session-session-20250826-160258",
"session-session-20250826-155049",
"session-session-20250826-151320",
"session-session-20250826-144858",
"session-session-20250826-143238",
"session-session-20250826-142549",
"session-session-20250826-141907",
"session-session-20250826-141841",
"session-session-20250821-193619",
"session-session-20250821-193306",
"session-session-20250821-191522",
"session-session-20250821-191136",
"session-session-20250821-190142",
"session-session-20250821-185022",
"session-session-20250821-183826",
"session-session-20250821-182804",
"session-session-20250816-171743",
"session-session-20250816-171018",
"session-session-20250816-170930",
"session-session-20250816-170903",
"task-20250816-165951",
"task-20250816-165440",
"task-20250816-165347",
"task-20250816-165337",
"task-20250816-165213",
"task-20250816-164812",
"task-20250816-164744",
"task-20250816-164733",
"task-20250816-164538",
"task-20250816-163919",
"task-20250816-163747",
"task-20250816-163314",
"task-20250816-162839",
"task-20250816-161821",
"task-20250816-160821",
"task-20250816-153756",
"task-20250816-153336",
"task-20250816-152451",
"task-20250816-151342",
"task-20250816-150726",
"task-20250816-150710",
"task-20250816-145917",
"task-20250816-145639",
"task-20250816-144448",
"task-20250816-144335",
"task-20250816-143833",
"task-20250816-143429",
"task-20250816-143240",
"task-20250816-143159",
"task-20250816-142809",
"task-20250816-142521",
"task-20250816-142500",
"task-20250816-142123",
"task-20250816-142102",
"task-20250816-141838",
"session-session-20250816-170504",
"session-session-20250816-165635",
"session-session-20250816-165349",
"session-session-20250816-165339",
"session-session-20250816-165311",
"session-session-20250816-165112",
"session-session-20250816-164517",
"session-session-20250816-163149",
"session-session-20250816-162716",
"session-session-20250816-161810",
"session-session-20250816-155917",
"session-session-20250816-153612",
"session-session-20250816-153225",
"session-session-20250816-151945",
"session-session-20250816-150907",
"session-session-20250816-150714",
"session-session-20250816-150700",
"session-session-20250816-150009",
"session-session-20250816-145523",
"session-session-20250816-144550",
"session-session-20250816-144213",
"session-session-20250816-144204",
"session-session-20250816-143645",
"session-session-20250816-143344",
"session-session-20250816-143114",
"session-session-20250816-142659",
"task-20250814-165725",
"task-20250814-165710",
"task-20250814-145435",
"task-20250814-144253",
"task-20250814-141517",
"task-20250814-140814",
"session-session-20250814-141751",
"session-session-20250814-141120",
"task-20250813-215345",
"task-20250813-215238",
"task-20250813-215214",
"task-20250813-211451",
"task-20250813-210905",
"task-20250813-210522",
"task-20250813-210220",
"task-20250813-210152",
"task-20250813-210136",
"task-20250813-210117",
"task-20250813-205908",
"task-20250813-205844",
"task-20250813-204205",
"task-20250813-204102",
"task-20250813-204028",
"task-20250813-203908",
"task-20250813-203746",
"task-20250813-203728",
"task-20250813-203628",
"task-20250813-202904",
"task-20250813-202518",
"task-20250813-202355",
"task-20250813-202312",
"task-20250813-202238",
"task-20250813-201740",
"task-20250813-201645",
"task-20250813-200720",
"task-20250813-190912",
"task-20250813-190555",
"task-20250813-185948",
"task-20250813-185933",
"task-20250813-185900",
"task-20250813-185835",
"task-20250813-185825",
"task-20250813-185815",
"task-20250813-181353",
"task-20250813-180452",
"task-20250813-160353",
"task-20250813-150915",
"task-20250813-145657",
"task-20250813-144906",
"task-20250813-144457",
"task-20250813-144335",
"task-20250813-143745",
"task-20250813-143313",
"task-20250812-223103",
"task-20250812-221459",
"task-20250812-220955",
"task-20250812-220053",
"task-20250812-195655",
"task-20250812-194907",
"task-20250812-194534",
"task-20250812-194045",
"task-20250812-193719",
"task-20250812-193343",
"task-20250812-192916",
"task-20250812-192454",
"task-20250812-192027",
"task-20250812-192015",
"task-20250812-191953",
"task-20250812-191912",
"task-20250812-191903",
"task-20250812-191722",
"task-20250812-191712",
"task-20250812-191642",
"task-20250812-191627",
"task-20250812-191504",
"task-20250812-191423",
"task-20250812-191410",
"task-20250812-191402",
"task-20250812-191211",
"task-20250812-190746",
"task-20250812-190725",
"task-20250812-190653",
"task-20250812-190609",
"task-20250812-190321",
"task-20250812-190303",
"task-20250812-190301",
"task-20250812-190258",
"task-20250812-190253",
"task-20250812-190228",
"task-20250812-190042",
"task-20250812-190007",
"task-20250812-185855",
"task-20250812-185836",
"task-20250812-185657",
"task-20250812-185637",
"task-20250812-185617",
"task-20250812-185547",
"task-20250812-184623",
"task-20250812-184339",
"task-20250812-184315",
"task-20250812-183851",
"task-20250812-183658",
"task-20250812-183635",
"task-20250812-182759",
"task-20250812-182359",
"task-20250812-182153",
"task-20250812-181918",
"task-20250812-181339",
"task-20250812-180449",
"task-20250812-180155",
"task-20250812-175754",
"task-20250812-175534",
"task-20250812-174702",
"task-20250812-173948",
"task-20250812-173609",
"task-20250812-172952",
"task-20250812-171740",
"task-20250812-171417",
"task-20250812-165834",
"task-20250812-164753",
"task-20250812-164419",
"task-20250812-164021",
"task-20250812-163724",
"task-20250812-161618",
"task-20250812-160020",
"task-20250812-155509",
"task-20250812-155352",
"task-20250812-155257",
"task-20250812-154908",
"task-20250812-154745",
"task-20250812-154659",
"task-20250812-154541",
"task-20250812-154055",
"task-20250812-153913",
"task-20250812-153745",
"task-20250812-153251",
"task-20250812-153042",
"task-20250812-151014",
"task-20250812-150718",
"task-20250812-150658",
"task-20250812-150622",
"task-20250812-150554",
"task-20250812-150213",
"task-20250812-150032",
"task-20250812-145716",
"task-20250812-144827",
"task-20250812-143801",
"task-20250812-143739",
"task-20250812-143705",
"task-20250812-143654",
"task-20250812-143607",
"task-20250812-143142",
"task-20250812-142819",
"task-20250812-142418",
"task-20250812-141749",
"task-20250812-141536",
"task-20250812-023458",
"task-20250811-215206",
"task-20250811-215039",
"task-20250811-213728",
"task-20250811-213500",
"task-20250811-212434",
"task-20250811-212053",
"task-20250811-211955",
"task-20250811-211732",
"task-20250811-210628",
"task-20250811-210023",
"task-20250811-205948",
"task-20250811-205927",
"task-20250811-205502",
"task-20250811-204118",
"task-20250811-202733",
"task-20250811-201512",
"task-20250811-194359",
"task-20250811-190649",
"task-20250811-185933",
"task-20250811-185818",
"task-20250811-185706",
"task-20250811-185547",
"task-20250811-185314",
"task-20250811-143952",
"task-20250811-141517",
"task-20250811-141331",
"task-20250807-172743",
"session-session-20250813-220001",
"session-session-20250813-211415",
"session-session-20250813-210745",
"session-session-20250813-210240",
"session-session-20250813-210008",
"session-session-20250813-204229",
"session-session-20250813-204113",
"session-session-20250813-202247",
"session-session-20250813-202224",
"session-session-20250813-201703",
"session-session-20250813-190921",
"session-session-20250813-190738",
"session-session-20250813-180939",
"session-session-20250813-160651",
"session-session-20250813-151139",
"session-session-20250813-150640",
"session-session-20250813-143613",
"session-session-20250812-223458",
"session-session-20250812-221712",
"session-session-20250812-221314",
"session-session-20250812-220533",
"session-session-20250812-195832",
"session-session-20250812-195642",
"session-session-20250812-194751",
"session-session-20250812-193848",
"session-session-20250812-193528",
"session-session-20250812-193203",
"session-session-20250812-192653",
"session-session-20250812-192052",
"session-session-20250812-192036",
"session-session-20250812-192021",
"session-session-20250812-192009",
"session-session-20250812-191916",
"session-session-20250812-191906",
"session-session-20250812-191736",
"session-session-20250812-191716",
"session-session-20250812-191645",
"session-session-20250812-191636",
"session-session-20250812-191631",
"session-session-20250812-191414",
"session-session-20250812-191408",
"session-session-20250812-191042",
"session-session-20250812-190902",
"session-session-20250812-190814",
"session-session-20250812-190752",
"session-session-20250812-190730",
"session-session-20250812-190657",
"session-session-20250812-190623",
"session-session-20250812-190613",
"session-session-20250812-190433",
"session-session-20250812-190233",
"session-session-20250812-190135",
"session-session-20250812-190056",
"session-session-20250812-190006",
"session-session-20250812-185841",
"session-session-20250812-185822",
"session-session-20250812-185643",
"session-session-20250812-185625",
"session-session-20250812-184627",
"session-session-20250812-184344",
"session-session-20250812-184319",
"session-session-20250812-183749",
"session-session-20250812-182417",
"session-session-20250812-182341",
"session-session-20250812-181809",
"session-session-20250812-180929",
"session-session-20250812-180342",
"session-session-20250812-175952",
"session-session-20250812-175343",
"session-session-20250812-174256",
"session-session-20250812-173803",
"session-session-20250812-172533",
"session-session-20250812-170545",
"session-session-20250812-165624",
"session-session-20250812-164725",
"session-session-20250812-161936",
"session-session-20250812-160453",
"session-session-20250812-155903",
"session-session-20250812-155441",
"session-session-20250812-155238",
"session-session-20250812-154825",
"session-session-20250812-154646",
"session-session-20250812-153908",
"session-session-20250812-153223",
"session-session-20250812-151438",
"session-session-20250812-150742",
"session-session-20250812-150641",
"session-session-20250812-150459",
"session-session-20250812-145428",
"session-session-20250812-144654",
"session-session-20250812-143337",
"session-session-20250812-143045",
"session-session-20250812-142758",
"session-session-20250812-142301",
"session-session-20250812-030438",
"session-session-20250811-215220",
"session-session-20250811-213547",
"session-session-20250811-213411",
"session-session-20250811-210754",
"session-session-20250811-210336",
"session-session-20250811-205608",
"session-session-20250811-204609",
"session-session-20250811-202920",
"session-session-20250811-201653",
"session-session-20250811-191203",
"session-session-20250811-190537",
"session-session-20250811-185934",
"session-session-20250811-185901",
"session-session-20250811-185512",
"session-session-20250811-144236",
"session-session-20250811-143232",
"session-session-20250807-173048",
"task-20250807-171427",
"task-20250807-170121",
"task-20250807-165601",
"task-20250807-164206",
"task-20250807-164137",
"task-20250807-163951",
"task-20250807-163715",
"task-20250807-162646",
"task-20250807-161839",
"task-20250807-161219",
"task-20250807-145800",
"task-20250807-145649",
"task-20250807-145341",
"task-20250807-145322",
"task-20250807-142936",
"task-20250807-142900",
"task-20250807-142740",
"task-20250807-142703",
"task-20250807-142612",
"task-20250807-142605",
"task-20250807-142539",
"task-20250807-142513",
"task-20250807-142452",
"task-20250807-142436",
"task-20250807-142241",
"task-20250807-142134",
"task-20250807-142127",
"task-20250807-141735",
"task-20250807-141541",
"task-20250807-141106",
"task-20250807-141033",
"task-20250807-141001",
"task-20250807-140913",
"task-20250807-140828",
"task-20250807-140758",
"task-20250807-140555",
"task-20250807-140442",
"task-20250807-140358",
"task-20250807-140044",
"task-20250807-135705",
"task-20250807-135539",
"task-20250807-135422",
"task-20250807-134519",
"task-20250807-134440",
"task-20250807-132744",
"task-20250807-132517",
"task-20250807-132107",
"session-session-20250807-171831",
"session-session-20250807-170706",
"session-session-20250807-165844",
"session-session-20250807-164536",
"session-session-20250807-164014",
"session-session-20250807-150203",
"session-session-20250807-144326",
"session-session-20250807-141445",
"session-session-20250807-135303",
"session-session-20250807-132330",
"session-session-20250807-132048",
"task-20250807-131824",
"session-session-20250807-131651",
"task-20250805-200300",
"task-20250805-200031",
"task-20250805-195421",
"task-20250805-195224",
"task-20250805-195023",
"task-20250805-194954",
"session-session-20250805-200233",
"session-session-20250805-195928",
"session-session-20250805-195416",
"session-session-20250805-195158",
"session-session-20250805-195010",
"session-session-20250805-194932",
"task-20250805-194516",
"task-20250805-194510",
"task-20250805-194253",
"task-20250805-194053",
"task-20250805-193843",
"session-session-20250805-194451",
"task-20250805-193535",
"task-20250805-193414",
"task-20250805-193403",
"task-20250805-193319",
"task-20250805-141418",
"task-20250805-135114",
"task-20250805-134636",
"session-session-20250805-193618",
"session-session-20250805-135408",
"session-session-20250805-134756",
"task-20250805-130639",
"task-20250805-130401",
"task-20250805-130146",
"task-20250805-125808",
"task-20250805-125501",
"task-20250805-125238",
"task-20250805-124804",
"task-20250805-124604",
"task-20250805-124533",
"task-20250805-124505",
"task-20250805-124346",
"task-20250805-123925",
"task-20250805-123603",
"task-20250805-122955",
"task-20250805-122801",
"task-20250805-034330",
"task-20250805-034105",
"task-20250805-033857",
"task-20250805-033525",
"task-20250805-033312",
"task-20250805-033305",
"task-20250805-033218",
"task-20250805-033154",
"task-20250805-033106",
"task-20250805-032943",
"task-20250805-032850",
"task-20250805-032825",
"task-20250805-032744",
"task-20250805-032518",
"task-20250805-032353",
"task-20250805-032301",
"task-20250805-031918",
"task-20250805-031658",
"task-20250805-031341",
"task-20250805-030326",
"task-20250805-025716",
"task-20250805-025432",
"task-20250805-025223",
"task-20250805-025126",
"task-20250805-025120",
"task-20250805-024935",
"task-20250805-024748",
"task-20250805-024602",
"task-20250805-022843",
"task-20250805-022651",
"task-20250805-022505",
"task-20250805-022430",
"task-20250805-021841",
"task-20250805-021141",
"task-20250805-020450",
"task-20250805-015639",
"task-20250805-015027",
"task-20250805-014718",
"task-20250805-014456",
"task-20250805-014258",
"task-20250805-014244",
"task-20250805-014032",
"task-20250805-013813",
"task-20250805-013741",
"task-20250805-013546",
"task-20250805-013122",
"task-20250805-013038",
"task-20250805-012935",
"task-20250805-012802",
"task-20250805-012712",
"task-20250805-012658",
"task-20250805-012408",
"task-20250805-012152",
"task-20250805-011714",
"task-20250805-011526",
"task-20250805-011355",
"task-20250805-011335",
"task-20250804-222319",
"task-20250804-221539",
"task-20250804-221431",
"task-20250804-221310",
"task-20250804-221136",
"task-20250804-221052",
"task-20250804-221030",
"task-20250804-220914",
"task-20250804-220832",
"task-20250804-220701",
"task-20250804-220339",
"task-20250804-215226",
"task-20250804-212434",
"task-20250804-212119",
"task-20250804-212035",
"task-20250804-211749",
"task-20250804-211647",
"task-20250804-211644",
"task-20250804-211643",
"task-20250804-211642",
"task-20250804-211530",
"task-20250804-211318",
"task-20250804-211035",
"task-20250804-211032",
"task-20250804-210955",
"task-20250804-203245",
"task-20250804-202856",
"task-20250804-202509",
"task-20250804-202443",
"task-20250804-202159",
"task-20250804-202103",
"task-20250804-202047",
"task-20250804-201718",
"task-20250804-201503",
"task-20250804-201439",
"task-20250804-201240",
"task-20250804-201134",
"task-20250804-200830",
"task-20250804-200715",
"task-20250804-200458",
"task-20250804-200358",
"task-20250804-200353",
"task-20250804-200349",
"task-20250804-200346",
"task-20250804-200343",
"task-20250804-200340",
"task-20250804-200010",
"task-20250804-195738",
"task-20250804-195621",
"task-20250804-193040",
"task-20250804-192745",
"task-20250804-191842",
"task-20250804-191642",
"task-20250804-191641",
"task-20250804-191640",
"task-20250804-190714",
"task-20250804-190713",
"task-20250804-190409",
"task-20250804-154701",
"task-20250804-154423",
"task-20250804-150408",
"task-20250804-145748",
"task-20250804-143827",
"task-20250804-143148",
"task-20250804-142932",
"task-20250804-142549",
"task-20250804-142319",
"task-20250804-142113",
"task-20250804-141618",
"task-20250804-141453",
"task-20250804-141306",
"task-20250804-141231",
"task-20250804-141114",
"task-20250804-140832",
"task-20250804-140610",
"task-20250804-140433",
"task-20250803-135230",
"task-20250803-134957",
"task-20250803-134913",
"task-20250803-134837",
"task-20250803-134216",
"task-20250803-134135",
"session-session-20250805-131013",
"session-session-20250805-130533",
"session-session-20250805-130337",
"session-session-20250805-125824",
"session-session-20250805-125244",
"session-session-20250805-125154",
"session-session-20250805-124747",
"session-session-20250805-123834",
"session-session-20250805-123114",
"session-session-20250805-034626",
"session-session-20250805-034221",
"session-session-20250805-034018",
"session-session-20250805-033952",
"session-session-20250805-033916",
"session-session-20250805-033410",
"session-session-20250805-032354",
"session-session-20250805-032142",
"session-session-20250805-031705",
"session-session-20250805-031257",
"session-session-20250805-030212",
"session-session-20250805-025600",
"session-session-20250805-025117",
"session-session-20250805-024100",
"session-session-20250805-022708",
"session-session-20250805-022303",
"session-session-20250805-020847",
"session-session-20250805-015650",
"session-session-20250805-015045",
"session-session-20250805-014540",
"session-session-20250805-014220",
"session-session-20250805-013657",
"session-session-20250805-012638",
"session-session-20250805-012330",
"session-session-20250805-012305",
"session-session-20250805-011856",
"session-session-20250804-222838",
"session-session-20250804-221845",
"session-session-20250804-221525",
"session-session-20250804-221342",
"session-session-20250804-220835",
"session-session-20250804-215710",
"session-session-20250804-212237",
"session-session-20250804-212010",
"session-session-20250804-211630",
"session-session-20250804-211223",
"session-session-20250804-202452",
"session-session-20250804-202423",
"session-session-20250804-201549",
"session-session-20250804-201535",
"session-session-20250804-200221",
"session-session-20250804-193339",
"session-session-20250804-193135",
"session-session-20250804-192750",
"session-session-20250804-190944",
"session-session-20250804-160249",
"session-session-20250804-154849",
"session-session-20250804-153739",
"session-session-20250804-151308",
"session-session-20250804-151200",
"session-session-20250804-151134",
"session-session-20250804-151119",
"session-session-20250804-150637",
"session-session-20250804-143404",
"session-session-20250804-143045",
"session-session-20250804-142717",
"session-session-20250804-142026",
"session-session-20250804-141525",
"session-session-20250804-141337",
"session-session-20250804-141254",
"session-session-20250804-141140",
"session-session-20250804-141009",
"session-session-20250804-140753",
"session-session-20250804-140521",
"session-session-20250803-135735",
"session-session-20250803-135226",
"session-session-20250803-134859",
"session-session-20250803-134440",
"session-session-20250803-134203",
"task-20250803-133007",
"task-20250803-132307",
"task-20250803-132255",
"task-20250803-132133",
"task-20250803-131717",
"task-20250803-130723",
"task-20250803-130604",
"task-20250803-130059",
"task-20250803-125719",
"task-20250803-125636",
"task-20250803-125551",
"task-20250803-125412",
"task-20250803-125401",
"task-20250803-125242",
"task-20250803-125213",
"task-20250803-125102",
"task-20250803-125049",
"task-20250803-124930",
"task-20250803-124422",
"task-20250803-124039",
"task-20250803-123839",
"task-20250803-123535",
"task-20250803-123422",
"task-20250803-123416",
"task-20250803-123410",
"task-20250803-123351",
"task-20250803-123325",
"task-20250803-123313",
"task-20250803-123303",
"task-20250803-123247",
"task-20250803-123203",
"task-20250803-122721",
"task-20250803-122429",
"task-20250803-121821",
"task-20250803-121746",
"task-20250803-121526",
"task-20250803-121456",
"task-20250803-121455",
"task-20250803-121332",
"task-20250803-121256",
"task-20250803-120932",
"task-20250801-192024",
"session-session-20250803-133416",
"session-session-20250803-132205",
"session-session-20250803-131649",
"session-session-20250803-130622",
"session-session-20250803-130618",
"session-session-20250803-125814",
"session-session-20250803-125710",
"session-session-20250803-125615",
"session-session-20250803-125437",
"session-session-20250803-125303",
"session-session-20250803-125126",
"session-session-20250803-124952",
"session-session-20250803-124510",
"session-session-20250803-123910",
"session-session-20250803-123704",
"session-session-20250803-122706",
"session-session-20250801-192641",
"task-20250801-185012",
"task-20250801-184904",
"task-20250801-184816",
"task-20250801-184749",
"task-20250801-184727",
"task-20250801-184648",
"task-20250801-183502",
"task-20250801-183056",
"task-20250801-181824",
"task-20250801-181721",
"task-20250801-180033",
"task-20250801-174813",
"task-20250801-174657",
"task-20250801-170812",
"task-20250801-170249",
"task-20250801-165920",
"task-20250801-165846",
"task-20250801-164439",
"task-20250731-203756",
"task-20250731-202541",
"task-20250731-201635",
"task-20250731-201347",
"task-20250731-201236",
"session-session-20250801-185805",
"session-session-20250801-183424",
"session-session-20250801-182959",
"session-session-20250801-180233",
"session-session-20250801-175251",
"session-session-20250801-174746",
"session-session-20250801-172331",
"session-session-20250801-170732",
"session-session-20250801-170008",
"session-session-20250801-165902",
"session-session-20250801-165013",
"session-session-20250731-204824",
"session-session-20250731-202811",
"session-session-20250731-201737",
"session-session-20250731-201542",
"session-session-20250731-195358",
"task-20250731-194807",
"task-20250731-194407",
"task-20250731-194245",
"task-20250731-193912",
"task-20250731-193834",
"task-20250731-193336",
"task-20250731-193051",
"task-20250731-193000",
"task-20250731-192800",
"task-20250731-192644",
"task-20250731-192434",
"task-20250731-192421",
"task-20250731-191923",
"task-20250731-191546",
"task-20250731-164929",
"task-20250731-164743",
"task-20250731-164657",
"task-20250731-164314",
"task-20250731-164223",
"task-20250731-164047",
"task-20250731-163702",
"task-20250731-163426",
"task-20250731-162558",
"task-20250731-162349",
"task-20250731-162124",
"session-session-20250731-194343",
"session-session-20250731-194208",
"session-session-20250731-193748",
"session-session-20250731-193231",
"session-session-20250731-193121",
"session-session-20250731-193043",
"session-session-20250731-193038",
"session-session-20250731-193017",
"session-session-20250731-192913",
"session-session-20250731-192900",
"session-session-20250731-192839",
"session-session-20250731-192810",
"session-session-20250731-192711",
"session-session-20250731-192658",
"session-session-20250731-192632",
"session-session-20250731-192608",
"session-session-20250731-192226",
"session-session-20250731-192119",
"session-session-20250731-191747",
"session-session-20250731-165000",
"session-session-20250731-164821",
"session-session-20250731-164722",
"session-session-20250731-164245",
"session-session-20250731-164059",
"session-session-20250731-163727",
"session-session-20250731-163301",
"session-session-20250731-162510",
"session-session-20250731-162229",
"task-20250730-221107",
"task-20250730-220800",
"task-20250730-220532",
"session-session-20250730-222733",
"session-session-20250730-220954",
"session-session-20250730-220658"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-58195.json"
}
}
],
"modified": "2026-10-28T02:30:51.597378794Z",
"provider": "osv",
"references": [
"https://github.com/ruvnet/ruflo/releases/tag/v3.12.4",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/58xxx/CVE-2026-58195.json",
"https://github.com/ruvnet/agentic-flow/security/advisories/GHSA-vcv2-r9jh-99m5",
"https://nvd.nist.gov/vuln/detail/CVE-2026-58195",
"https://github.com/ruvnet/agentic-flow/issues/169",
"https://github.com/ruvnet/ruflo/issues/2414",
"https://github.com/ruvnet/agentic-flow/commit/0c2ec967736a8b6b85832c6bae2a3e74989705ec",
"https://github.com/ruvnet/agentic-flow/pull/170",
"https://github.com/ruvnet/ruflo/pull/2415"
],
"provider_metadata": {
"cwe_ids": [
"CWE-78"
],
"cna_assigner": "GitHub_M",
"unresolved_ranges": [
{
"extracted_events": [
{
"range": [
{
"fixed": "2.0.14"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
}
]
},
{
"extracted_events": [
{
"range": [
{
"fixed": "2.0.14"
},
{
"fixed": "2.0.14"
}
],
"source": "DESCRIPTION"
}
]
}
],
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/58xxx/CVE-2026-58195.json"
}
},
"related_cves": [
{
"value": "CVE-2026-58195",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 520431,
"published_at": "2026-07-17T18:47:05.179+00:00"
}