AI / ML CVE-2026-0759
CRITICALAttack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend malicious command string to executeCommand method
-
ExploitBypass input validation
-
ExecutionExecute arbitrary system command
-
ImpactAchieve remote code execution as service account
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions — remote unauthenticated exploitation against default Katana Network Development Starter Kit installations with exposed executeCommand method accepting user input without validation. |
| Impact | CVSS 9.8, EPSS 1.0%. Development kits often run with elevated privileges during development, amplifying the impact of RCE. |
| Exploit ScenarioDerived | An attacker exploits the command injection in Katana's executeCommand to gain shell access on the developer's machine. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
Katana Network Development Starter Kit has a command injection in executeCommand enabling remote code execution through the development framework.
Earlier versions of this analysis (1)
Command injection in Katana Development Kit enables RCE via crafted commands.
RemediationAI
Update the kit. Use parameterized command execution.
Affected ProductsAI
Katana Network Development Starter Kit
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The Katana Network Development Starter Kit has a CWE-78 command injection in the executeCommand function that allows remote attackers to inject arbitrary OS commands.
Know when AI / ML gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionCVE.org
Katana Network Development Starter Kit executeCommand Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Katana Network Development Starter Kit. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the implementation of the executeCommand method. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-27786.
Executive ViewAI
A critical remote code execution vulnerability (CVE-2026-0759) affects the Katana Network Development Starter Kit with a CVSS score of 9.8, allowing unauthenticated attackers to execute arbitrary commands on vulnerable systems. Organizations using this toolkit for network development face immediate risk of complete system compromise, data exfiltration, and lateral movement within their infrastructure. Urgent action is required to identify affected installations and implement mitigations, as no patch is currently available.
Implement network segmentation to restrict access to affected Katana systems; deploy Web Application Firewall (WAF) rules to detect and block executeCommand injection payloads; disable or restrict the vulnerable command injection endpoint if business operations permit; enforce strict input validation and output encoding at the application layer; implement enhanced monitoring and logging for suspicious command execution patterns; restrict outbound network connectivity from affected systems to limit data exfiltration; consider containerization with strict resource and network policies as interim containment.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
MCPJam Inspector versions 1.4.2 and earlier allow unauthenticated remote code execution through missing authentication i
Langflow has a code injection vulnerability in the code component (EPSS 2.6%) enabling remote code execution through the
Langflow has an eval injection in eval_custom_component_code (EPSS 2.0%) enabling remote code execution through crafted
A path traversal vulnerability exists in mlflow/mlflow version 2.15.1. Rated high severity (CVSS 7.5), this vulnerabilit
Code injection in Langflow CSV Agent node before 1.8.0. The node hardcodes allow_dangerous_code=True, enabling arbitrary
Sandbox escape in Enclave JavaScript sandbox before 2.11.1. Enclave is designed for safe AI agent code execution — the e
enclave-vm JavaScript sandbox (before 2.7.0) has a critical sandbox escape. When a tool invocation fails, a host-side Er
A remote code execution vulnerability in langchain-ai/langchain (CVSS 10.0). Risk factors: public PoC available. Vendor
n8n has a fifth critical RCE vulnerability (CVSS 9.9) in the Expression evaluator, enabling code execution through craft
Path traversal vulnerability in RAGFlow RAG engine version 0.23.1 allows unauthenticated attackers to read arbitrary fil
WeKnora LLM framework (before 0.2.5) allows authenticated users to inject MCP stdio commands that the server executes as
OS command injection in WeKnora from version 0.2.5 allows authenticated users to execute arbitrary system commands. CVSS
GitHub PoC
Exploit-DB