EUVD-2026-17423Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (mitre) · only source for this CVE.
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
Ridvay Code's command auto-approval module contains a critical OS command injection vulnerability that renders its whitelist security mechanism completely ineffective. The system relies on fragile regular expressions to parse command structures; while it attempts to intercept dangerous operations, it fails to account for standard Shell command substitution Ridvay Code (specifically$(...)and backticks ...). An attacker can construct a command such as git log --grep="$(malicious_command)", forcing Syntx to misidentify it as a safe git operation and automatically approve it. The underlying Shell prioritizes the execution of the malicious code injected within the arguments, resulting in Remote Code Execution without any user interaction.
AnalysisAI
Remote code execution in Ridvay Code's command auto-approval module allows unauthenticated attackers to bypass whitelist protections via shell command substitution syntax ($(…) and backticks) embedded in seemingly benign git commands, achieving code execution without user interaction. The vulnerability exploits inadequate regular expression validation that fails to detect shell metacharacters in command arguments, enabling attackers to inject arbitrary commands that execute with the privileges of the Ridvay Code process.
Technical ContextAI
Ridvay Code implements a command auto-approval system intended to safely permit certain operations by validating commands against a whitelist using regular expressions. The vulnerability stems from insufficient parsing logic that does not account for shell command substitution mechanisms-specifically the $(command) syntax and backtick command substitution-which are evaluated by the underlying shell interpreter after the whitelist check passes. The root cause is inadequate input validation at the command parsing layer (CWE-77/CWE-78 territory: Improper Neutralization of Special Elements used in a Command). An attacker can embed malicious shell syntax within ostensibly safe arguments (e.g., git log parameters), causing the shell to execute the injected code before or alongside the whitelisted command. This represents a failure to perform proper sanitization or escaping of shell metacharacters prior to command execution.
RemediationAI
Immediate remediation requires disabling or removing the command auto-approval feature entirely until a patched version is available, or restricting its use to isolated, non-production environments. The underlying fix must involve secure command parsing: reject any command string or argument containing shell metacharacters ($(, , , |, ;, &, >, <, etc.) before whitelist evaluation, or use a secure command execution API (e.g., language-native system calls that accept argument arrays rather than shell strings, preventing interpretation of shell syntax). Patch availability has not been confirmed from vendor advisory; users should monitor https://ridvay.com/ and https://github.com/Secsys-FDU/LLM-Tool-Calling-CVEs/issues/8 for security updates. As an interim control, if the auto-approval mechanism can be disabled via configuration, do so immediately and require explicit manual approval for all commands.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-78 – OS Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today