HKUDS AnyTool CVE-2026-102874

Requires that the AnyTool 0.1.0 local_server Execute Endpoint (anytool/local_server/main.py) be network-reachable by the attacker; per the CVSS vector this is unauthenticated (PR:N) with no user interaction (UI:N) and low complexity. The concrete prerequisite is that the 'command'/'shell' argument accepted by the Execute Endpoint reaches subprocess.run, so any deployment exposing that endpoint on an accessible interface is exploitable. Primary limiting factor is exposure/deployment: this is an early-stage research tool typically run locally, so risk depends on whether the local_server is bound to a reachable network interface rather than loopback-only.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remotely reachable, low-complexity, unauthenticated OS command injection - the highest-exposure profile possible - yet VulDB rated only 6.9 by scoring impact conservatively as VC:L/VI:L/VA:L. That impact rating understates a CWE-78 flaw where user-controlled 'command'/'shell' arguments flow into subprocess.run: successful command injection typically yields full code execution on the host, warranting HIGH confidentiality/integrity/availability rather than LOW. Exploitation status is 'publicly available exploit code exists' (POC referenced in GitHub issue #6); there is no EPSS score and no CISA KEV listing, so there is 'no public exploit identified' as actively exploited in the wild - treat as POC-available but not confirmed weaponized. The controlling limiter is not the vulnerability mechanics (which are trivial) but deployment footprint: AnyTool 0.1.0 is an early-version niche open-source research/agent tool from HKUDS, so real-world exposure is small. Net: technically a serious unauthenticated RCE-class bug, but priority is moderated by rarity and the absence of active-exploitation signals. The E:P (Proof-of-Concept) exploit maturity in the vendor vector aligns with the POC-available finding.

An attacker locates an exposed AnyTool local_server Execute Endpoint and sends a crafted request whose 'command' or 'shell' argument embeds shell metacharacters or additional commands. Because subprocess.run executes the attacker-influenced string without sanitization and no authentication is required, the injected commands run in the context of the server process, giving arbitrary command execution on the host. A public proof-of-concept exists in GitHub issue #6, lowering the skill barrier.