What is the CVSS score of CVE-2026-25807?

CVE-2026-25807 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Zai Shell are affected by CVE-2026-25807?

ZAI Shell versions prior to 9.0.3 contain an unauthenticated remote access vulnerability in the P2P terminal sharing feature that could allow attackers to gain unauthorized system access without…. A patch is available.

Is there a public PoC exploit available for CVE-2026-25807?

Yes, a public proof-of-concept exploit is available for CVE-2026-25807. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-25807?

Within 24 hours: Identify all ZAI Shell deployments and document current versions in use. Within 7 days: Upgrade all instances to version 9.0.3 or later; if immediate patching is not feasible, disable the P2P terminal sharing feature (share start command) across all systems. Within 30 days: Conduct vulnerability scan to verify successful patching and review access logs for any unauthorized port 5757 connections during the exposure window.

Zai Shell CVE-2026-25807

HIGH

Code Injection (CWE-94)

2026-02-09 security-advisories@github.com

RCE Code Injection Zai Shell

8.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

PoC Detected

Feb 24, 2026 - 18:13 vuln.today

Public exploit code

Patch released

Feb 24, 2026 - 18:13 nvd

Patch available

CVE Published

Feb 09, 2026 - 22:16 nvd

HIGH 8.8

DescriptionGitHub Advisory

ZAI Shell is an autonomous SysOps agent designed to navigate, repair, and secure complex environments. Prior to 9.0.3, the P2P terminal sharing feature (share start) opens a TCP socket on port 5757 without any authentication mechanism. Any remote attacker can connect to this port using a simple socket script. An attacker who connects to a ZAI-Shell P2P session running in --no-ai mode can send arbitrary system commands. If the host user approves the command without reviewing its contents, the command executes directly with the user's privileges, bypassing all Sentinel safety checks. This vulnerability is fixed in 9.0.3.

AnalysisAI

Unauthenticated remote code execution in Zai Shell prior to 9.0.3 via the unprotected P2P terminal sharing feature on port 5757, where attackers can inject arbitrary system commands that execute with user privileges if approved. Public exploit code exists for this vulnerability, and affected systems running --no-ai mode completely bypass safety checks during command execution. Update to version 9.0.3 to remediate.

Technical ContextAI

Classified as CWE-94 (Code Injection). Affects Zai Shell. ZAI Shell is an autonomous SysOps agent designed to navigate, repair, and secure complex environments. Prior to 9.0.3, the P2P terminal sharing feature (share start) opens a TCP socket on port 5757 without any authentication mechanism. Any remote attacker can connect to this port using a simple socket script. An attacker who connects to a ZAI-Shell P2P session running in --no-ai mode can send arbitrary system commands. If the host user approves the command without reviewing its contents, the com