EUVD-2026-52222
GHSA-x3p6-h888-267q
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network vector and no privileges required align with description; high complexity reflects difficult exploitability; unchanged scope and low CIA match the bounded sandbox escape impact.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A weakness has been identified in vxcontrol PentAGI up to 2.1.0. This affects an unknown part of the file backend/pkg/templates/prompts/pentester.tmpl of the component Tool Management Protocol Handler. Executing a manipulation can lead to sandbox issue. It is possible to launch the attack remotely. The attack requires a high level of complexity. It is indicated that the exploitability is difficult. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Sandbox escape in vxcontrol PentAGI up to 2.1.0 exposes a privilege boundary weakness in the Tool Management Protocol Handler, rooted in the pentester prompt template file. Remote unauthenticated attackers who can craft sufficiently complex inputs may bypass sandbox constraints on the AI agent's tool execution context, achieving limited confidentiality, integrity, and availability impact against the vulnerable system. A public proof-of-concept exists on GitHub; no patch has been released and the vendor has not responded to disclosure - leaving all deployments on versions up to 2.1.0 without a vendor-sanctioned fix.
Technical ContextAI
PentAGI is an AI-powered autonomous penetration testing framework developed by vxcontrol (CPE: cpe:2.3:a:vxcontrol:pentagi:*:*:*:*:*:*:*:*). The vulnerability resides in backend/pkg/templates/prompts/pentester.tmpl, which defines the prompt structure governing the AI agent's tool-use decisions within its Tool Management Protocol Handler. CWE-265 (Privilege Issues) indicates that the flaw involves inadequate enforcement of privilege or capability boundaries - in this context, the sandbox restrictions governing which tools the AI agent may invoke or what data it may access. This class of weakness is particularly relevant to agentic AI systems that rely on prompt templates to constrain autonomous tool execution: a manipulation of the template handling logic can allow the agent to exceed its intended privilege envelope, effectively escaping the sandboxed execution context.
RemediationAI
No vendor-released patch has been identified at time of analysis - the vendor did not respond to responsible disclosure. As a primary compensating control, operators should restrict network-level access to the PentAGI Tool Management Protocol Handler endpoint to trusted hosts only, reducing the network-accessible attack surface consistent with the AV:N vector. Given that the attack requires high complexity (AC:H), isolating the service behind a VPN or API gateway with strict allowlisting of callers is a practical hardening measure with minimal operational trade-off. Operators should monitor the public proof-of-concept repository at https://github.com/ez-lbz/pentagi-vul-report for updated exploit capability that may lower exploitation complexity over time. Disabling or restricting the pentester template's tool-calling capabilities at the configuration level, if the framework supports granular tool permissions, would further limit the exploitable surface. Upgrade to a version beyond 2.1.0 if and when the vendor releases a fix; watch VulDB tracking at https://vuldb.com/vuln/385421 for patch availability updates.
Same weakness CWE-265 – Privilege Issues
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today