EUVD-2026-17205
GHSA-rfcm-98h7-2567
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
DSAI-Cline's command auto-approval module contains a critical OS command injection vulnerability that renders its whitelist security mechanism completely ineffective. The system relies on string-based parsing to validate commands; while it intercepts dangerous operators such as ;, &&, ||, |, and command substitution patterns, it fails to account for raw newline characters embedded within the input. An attacker can construct a payload by embedding a literal newline between a whitelisted command and malicious code (e.g., git log malicious_command), forcing DSAI-Cline to misidentify it as a safe operation and automatically approve it. The underlying PowerShell interpreter treats the newline as a command separator, executing both commands sequentially, resulting in Remote Code Execution without any user interaction.
AnalysisAI
Remote code execution in DSAI-Cline's command auto-approval module allows unauthenticated attackers to bypass whitelist validation by embedding newline characters in command payloads, forcing automatic approval and sequential execution of arbitrary OS commands via PowerShell without user interaction.
Technical ContextAI
DSAI-Cline implements a command filtering mechanism that attempts to prevent OS command injection by detecting dangerous shell operators (semicolons, logical operators &&/||, pipes, and command substitution patterns). However, the validation logic uses string-based parsing that fails to account for raw newline characters (\n) as command separators. In PowerShell and many Unix shells, newline characters function as command terminators and separators, equivalent to semicolons. An attacker can craft a payload such as 'git log\nmalicious_command' where the newline is treated as a valid separator by the shell interpreter while remaining undetected by the whitelist parser. This allows the first (whitelisted) command to execute normally, followed immediately by arbitrary malicious code. The root cause is insufficient input validation that does not normalize or filter all shell metacharacters and separators before approval logic is applied.
RemediationAI
Immediate action required: apply a patch that implements comprehensive input validation by normalizing and filtering all shell metacharacters including newline (\n, \r), carriage return, and other whitespace control characters before command approval logic is executed. The whitelist should be refactored to use parameterized command construction or shell-aware parsing libraries rather than string-based pattern matching. Contact DSAI-Cline maintainers via the GitHub repositories referenced (necboy/cline-DSAI and Secsys-FDU/LLM-Tool-Calling-CVEs) for patch availability and timeline. Until a patch is released, disable auto-approval functionality entirely and require explicit user confirmation for all command execution, or restrict DSAI-Cline to a sandboxed environment with limited OS command privileges.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-94 – Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today