CAI find_file Agent Tool has Command Injection Vulnerability Through Argument Injection

{
  "id": "3f64d5184b18b44c463ab86599dbf5602864c7f8c548a46251db91bfff311ac0",
  "url": "https://osv.dev/vulnerability/GHSA-jfpc-wj3m-qw2m",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "CAI find_file Agent Tool has Command Injection Vulnerability Through Argument Injection",
    "summary": "## Summary The CAI (Cybersecurity AI) framework contains multiple argument injection vulnerabilities in its function tools. User-controlled input is passed directly to shell commands via `subprocess.Popen()` with `shell=True`, allowing attackers to execute arbitrary commands on the host system. ## Vulnerable Component **Function:** `find_file()` in `src/cai/tools/reconnaissance/filesystem.py` [code](https://github.com/aliasrobotics/cai/blob/559de8fcbc2b44f3b0360f35ffdc2bb975e7d7e4/src/cai/tools/reconnaissance/filesystem.py#L60) ```python @function_tool def find_file(file_path: str, args: str = \"\", ctf=None) -> str: command = f'find {file_path} {args}' # No sanitization return run_command(command, ctf=ctf) # shell=True ``` ## Attack Vector An attacker can exploit this vulnerability through prompt injection: 1. Attacker hosts a webpage containing malicious instructions in HTML comments 2. Victim's CAI agent fetches and processes the webpage 3. Agent is tricked into calling `find_file()` with attacker-controlled arguments 4. The `-exec` flag enables arbitrary command execution ## Proof of Concept **Malicious payload in HTML comments:** ```html ``` **Resulting command execution:** ```bash find /tmp -true -exec sh -c 'echo pwned > /tmp/pwned' \\; ``` ## Impact The `find_file()` tool executes without requiring user approval because find is considered a \"safe\" pre-approved command. This means an attacker can achieve Remote Code Execution (RCE) by injecting malicious arguments (like -",
    "evidence": "osv:GHSA-jfpc-wj3m-qw2m",
    "products": [
      {
        "name": {
          "value": "cai-framework",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": [
          {
            "value": "0.3.10",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "0.3.11",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "0.3.12",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "0.3.13",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "0.3.14",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "0.3.9",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "0.4.0",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "0.5.0",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "0.5.1",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "0.5.10",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "0.5.2",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "0.5.3",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "0.5.4",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "0.5.5",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "0.5.6",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "0.5.7",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "0.5.8",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "0.5.9",
            "evidence": "/affected/0/versions"
          }
        ]
      }
    ],
    "severity": "critical",
    "structured": {
      "id": "GHSA-jfpc-wj3m-qw2m",
      "aliases": [
        "CVE-2026-25130",
        "GHSA-jfpc-wj3m-qw2m",
        "PYSEC-2026-303"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "last_affected": "0.5.10"
                }
              ]
            }
          ],
          "package": {
            "name": "cai-framework",
            "purl": "pkg:pypi/cai-framework",
            "ecosystem": "PyPI"
          },
          "versions": [
            "0.3.10",
            "0.3.11",
            "0.3.12",
            "0.3.13",
            "0.3.14",
            "0.3.9",
            "0.4.0",
            "0.5.0",
            "0.5.1",
            "0.5.10",
            "0.5.2",
            "0.5.3",
            "0.5.4",
            "0.5.5",
            "0.5.6",
            "0.5.7",
            "0.5.8",
            "0.5.9"
          ],
          "database_specific": {
            "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/01/GHSA-jfpc-wj3m-qw2m/GHSA-jfpc-wj3m-qw2m.json"
          }
        }
      ],
      "modified": "2026-10-27T15:30:03.269823289Z",
      "provider": "osv",
      "references": [
        "https://github.com/aliasrobotics/cai/security/advisories/GHSA-jfpc-wj3m-qw2m",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-25130",
        "https://github.com/aliasrobotics/cai/commit/e22a1220f764e2d7cf9da6d6144926f53ca01cde",
        "https://github.com/aliasrobotics/cai",
        "https://github.com/aliasrobotics/cai/blob/559de8fcbc2b44f3b0360f35ffdc2bb975e7d7e4/src/cai/tools/reconnaissance/filesystem.py#L60",
        "https://github.com/pypa/advisory-database/tree/main/vulns/cai-framework/PYSEC-2026-303.yaml",
        "https://pypi.org/project/cai-framework"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-78"
        ],
        "severity": "CRITICAL",
        "github_reviewed": true,
        "nvd_published_at": "2026-01-30T21:15:58Z",
        "github_reviewed_at": "2026-01-30T20:38:35Z"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-25130",
        "evidence": "/aliases"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/database_specific/severity"
  },
  "source_id": "core-osv",
  "document_id": 462831,
  "published_at": "2026-01-30T20:38:35+00:00"
}