CVE-2025-67511: Cybersecurity Ai: komut enjeksiyonu

Açıklama (NVD)

Cybersecurity AI (CAI) is an open-source framework for building and deploying AI-powered offensive and defensive automation. Versions 0.5.9 and below are vulnerable to Command Injection through the run_ssh_command_with_credentials() function, which is available to AI agents. Only password and command inputs are escaped in run_ssh_command_with_credentials to prevent shell injection; while username, host and port values are injectable. This issue does not have a fix at the time of publication.

Özet bilgiler

Ürün

Aliasrobotics Cybersecurity Ai

CVSS v3.1

9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

EPSS

%2,02 (yüzdelik 81)

CWE

CWE-77

Yama

Mevcut

Etkilenen sürümler

Kaynaklar

• NVD kaydı
• github.com
• github.com
• www.hacktivesecurity.com
• CWE-77