EUVD-2026-17203
GHSA-3m9f-mrx3-g4mq
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
In its design for automatic terminal command execution, SakaDev offers two options: Execute safe commands and execute all commands. The description for the former states that commands determined by the model to be safe will be automatically executed, whereas if the model judges a command to be potentially destructive, it still requires user approval. However, this design is highly susceptible to prompt injection attacks. An attacker can employ a generic template to wrap any malicious command and mislead the model into misclassifying it as a 'safe' command, thereby bypassing the user approval requirement and resulting in arbitrary command execution.
AnalysisAI
SakaDev's automatic terminal command execution feature can be bypassed via prompt injection attacks, allowing unauthenticated remote attackers to execute arbitrary commands without user approval by wrapping malicious commands in templates that mislead the underlying language model into misclassifying destructive operations as safe. The vulnerability exploits a design flaw in the model-based safety classification mechanism rather than a traditional code defect, affecting the extension across all versions where the 'Execute safe commands' option is enabled.
Technical ContextAI
SakaDev is a Visual Studio Code extension that integrates language model-based command execution automation. The extension implements a two-tier execution model: (1) automatic execution of commands the model deems 'safe', and (2) user-approval-gated execution for potentially destructive commands. The vulnerability stems from the reliance on prompt-injection-susceptible language model classification without secondary validation layers. This represents a class of AI/ML system vulnerabilities where adversarial prompts can subvert intended behavioral guardrails. The root cause lies in inadequate input sanitization and over-reliance on model judgment for security-critical decisions, rather than explicit command whitelisting or static analysis. No formal CWE mapping was provided, but the mechanism aligns with CWE-94 (Improper Control of Generation of Code), CWE-95 (Improper Neutralization of Directives in Dynamically Evaluated Code), and CWE-20 (Improper Input Validation).
RemediationAI
Immediate remediation requires SakaDev maintainers to implement input sanitization and command classification hardening: replace model-based safety judgment with explicit command whitelisting (curated list of genuinely non-destructive commands such as echo, cd, pwd), implement static syntax analysis to reject commands containing shell operators (pipes, redirects, semicolons, backticks, variable expansion), and require user approval for any command execution regardless of model classification until a formal security review is completed. Users should immediately disable the 'Execute safe commands' option and instead use the manual approval flow for all terminal commands, or uninstall the extension if command automation is not critical. The proof-of-concept and vulnerability details are documented at https://github.com/Secsys-FDU/LLM-Tool-Calling-CVEs/issues/4 and should be reviewed by the maintainers to understand the specific injection patterns being exploited. Vendor-released patch status is not confirmed in the provided data; users should monitor the Visual Studio Code Marketplace for extension updates and the GitHub repository for security advisories.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-94 – Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today