CVE-2026-30310

EUVD-2026-17410 CRITICAL

Command Injection (CWE-77)

2026-03-31 mitre

GHSA-cj5g-jjhr-x8g6

Command Injection

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 31, 2026 - 13:48 euvd

EUVD-2026-17410

Analysis Generated

Mar 31, 2026 - 13:48 vuln.today

CVE Published

Mar 31, 2026 - 00:00 nvd

CRITICAL 9.8

DescriptionCVE.org

In its design for automatic terminal command execution, Sixth offers two options: Execute safe commands and Execute all commands. The description for the former states that commands determined by the model to be safe will be automatically executed, whereas if the model judges a command to be potentially destructive, it still requires user approval. However, this design is highly susceptible to prompt injection attacks. An attacker can employ a generic template to wrap any malicious command and mislead the model into misclassifying it as a 'safe' command, thereby bypassing the user approval requirement and resulting in arbitrary command execution.

AnalysisAI

Prompt injection attacks in Sixth's automatic terminal command execution feature bypass the model-based safety classification system, allowing attackers to execute arbitrary commands without user approval by wrapping malicious payloads in templates that mislead the AI into treating them as safe operations.

Technical ContextAI

Sixth implements a two-tier command execution model where an AI language model classifies commands as either safe (auto-executed) or potentially destructive (requiring user approval). The vulnerability exploits the underlying LLM's susceptibility to prompt injection-a technique where specially crafted input manipulates the model's decision-making logic independently of actual command semantics. Rather than evaluating command safety based on objective criteria (e.g., file deletion, network access), the system relies on the model's subjective interpretation of text, which can be subverted through prompt injection templates. This is a form of authentication bypass where the intended human-in-the-loop safety gate (user approval) is circumvented at the AI classification stage. The affected product is Sixth, a tool that automates terminal command execution based on AI decision-making, identified via cpe:2.3:a:n/a:n/a:*:*:*:*:*:*:*:* (generic CPE indicating vendor/product data is unavailable in standard NVD format).

RemediationAI

No vendor-released patch identified at time of analysis. Immediate mitigations include: (1) disable the 'Execute safe commands' automatic execution feature entirely and require explicit user approval for all terminal commands regardless of AI classification; (2) implement additional input validation and prompt injection detection before command submission to the LLM classifier; (3) add a secondary human review step for any commands that cross system boundaries (file operations, network calls, process management). Users should contact Sixth support (https://trysixth.com/) and monitor the vulnerability tracking repository (https://github.com/Secsys-FDU/LLM-Tool-Calling-CVEs/issues/12) for patch releases and additional guidance.