OpenSRE CVE-2026-109444

The specific precondition is deployment of OpenSRE using the headless presenter (the subprocess_presenter path) whose execution_allowed() unconditionally returns True, which removes the human confirmation step before shell_run commands. The attacker must additionally be able to place crafted instructions into a source the agent triages - an alert feed or a Slack channel routed through the gateway dispatcher. Exploitation is limited to versions through 0.1.2026.10.19 and to this headless/non-interactive mode; deployments that keep an interactive approval presenter (one that actually enforces confirmation) are not in the always-True code path. Per CVSS no authentication or user interaction is required once a malicious message reaches the triaged channel, but the practical limiting factor is the attacker's ability to inject content into that monitored source.

Signals pull in two directions and must be weighed together. The CVSS 4.0 base vector (AV:N/AC:L/AT:N/PR:N/UI:N with VC:H/VI:H/VA:H) and the SSVC decision (Exploitation: poc, Automatable: yes, Technical Impact: total) describe a high-severity, low-friction flaw: a prompt-injected instruction reaching the agent leads to unconfirmed shell execution and full credential compromise, and the vuln.today Decision label is act_now. Against that, the market-level exploitation signal is modest: EPSS is only 0.45% (38th percentile), the product is not in CISA KEV, and the only exploit artifact is a reference, not verified working exploit code. The act_now urgency is therefore driven by intrinsic impact and automatability rather than by observed mass exploitation - treat it as a priority to patch, but note that low EPSS plus a niche product footprint argue for targeted rather than widespread opportunistic exploitation. No signals directly contradict each other, but the gap between critical severity/act_now and low EPSS/no-KEV should be read as 'serious but not yet demonstrably mass-exploited'; the fixed-version gap (see confidence notes) is the main open risk factor for defenders.

An attacker who can influence a monitored data source - e.g. an alerting pipeline or a Slack channel the OpenSRE agent triages - plants crafted instructions that the LLM agent interprets as a task to run a shell_run command. Because the headless presenter's execution_allowed() unconditionally returns True, the approval gate is skipped and the command runs on the host, enabling exfiltration of LLM, Slack and cloud credentials. A public PoC reference exists (Lasso/VulnCheck); it is not verified as working exploit code, and exploitation needs no authentication or user interaction per the CVSS vector.