What is the CVSS score of CVE-2026-25130?

CVE-2026-25130 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of AI / ML are affected by CVE-2026-25130?

A critical argument injection vulnerability (CVSS 9.6) exists in Cybersecurity AI framework versions up to 0.5.10 with no vendor patch currently available.

Is there a public PoC exploit available for CVE-2026-25130?

Yes, a public proof-of-concept exploit is available for CVE-2026-25130. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-25130?

Within 24 hours: Inventory all systems running CAI framework versions ≤0.5.10 and isolate affected instances from production networks if possible. Within 7 days: Implement network segmentation to restrict CAI framework access, disable function tools if not operationally critical, and apply WAF rules to filter malicious argument injection payloads. Within 30 days: Migrate to patched version when available from vendor, or evaluate alternative security frameworks with active vendor support.

AI / ML CVE-2026-25130

CRITICAL

OS Command Injection (CWE-78)

2026-01-30 security-advisories@github.com

GHSA-jfpc-wj3m-qw2m

RCE AI / ML

9.6

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:00 vuln.today

CVE Published

Jan 30, 2026 - 21:15 nvd

CRITICAL 9.6

DescriptionGitHub Advisory

Cybersecurity AI (CAI) is a framework for AI Security. In versions up to and including 0.5.10, the CAI (Cybersecurity AI) framework contains multiple argument injection vulnerabilities in its function tools. User-controlled input is passed directly to shell commands via subprocess.Popen() with shell=True, allowing attackers to execute arbitrary commands on the host system. The find_file() tool executes without requiring user approval because find is considered a "safe" pre-approved command. This means an attacker can achieve Remote Code Execution (RCE) by injecting malicious arguments (like -exec) into the args parameter, completely bypassing any human-in-the-loop safety mechanisms. Commit e22a1220f764e2d7cf9da6d6144926f53ca01cde contains a fix.

AnalysisAI

Multiple command injection vulnerabilities in CAI (Cybersecurity AI) framework up to 0.5.10 allow OS command execution through the security testing platform.