EUVD-2026-17427Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (mitre) · only source for this CVE.
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
Ridvay Code's command auto-approval module contains a critical OS command injection vulnerability that renders its whitelist security mechanism completely ineffective. The system relies on fragile regular expressions to parse command structures; while it attempts to intercept dangerous operations, it fails to account for standard Shell command substitution Ridvay Code (specifically$(...)and backticks ...). An attacker can construct a command such as git log --grep="$(malicious_command)", forcing Syntx to misidentify it as a safe git operation and automatically approve it. The underlying Shell prioritizes the execution of the malicious code injected within the arguments, resulting in Remote Code Execution without any user interaction.
AnalysisAI
Remote code execution in Ridvay Code's command auto-approval module allows unauthenticated attackers to bypass whitelist security controls via shell command substitution syntax (e.g., $(...) or backticks) embedded in command arguments. The vulnerability stems from insufficient regular expression validation that fails to detect command injection payloads, permitting an attacker to execute arbitrary OS commands with automatic approval. No user interaction is required; a crafted command such as git log --grep="$(malicious_command)" will be misidentified as safe and executed by the underlying shell, resulting in remote code execution.
Technical ContextAI
Ridvay Code implements a command auto-approval mechanism that uses regular expressions to whitelist safe operations. The vulnerability exploits a fundamental weakness in shell command parsing: the system validates the command structure but does not account for shell metacharacters and substitution mechanisms-specifically $(...) (command substitution) and backticks (...)-which are evaluated by the shell at runtime after the command passes the whitelist check. This is a classic case of CWE-78 (Improper Neutralization of Special Elements used in an OS Command). The affected component parses incoming commands to determine if they are safe (e.g., git operations) but the regex-based validation occurs at a syntactic level without consideration of shell expansion semantics. When a shell processes the approved command, it evaluates the embedded substitution syntax before executing the outer command, allowing injected payloads to run with the privileges of the Ridvay Code process.
RemediationAI
Immediate remediation requires vendor patching; no vendor-released patch version has been identified in available data. Organizations running Ridvay Code should contact the vendor (https://ridvay.com/) to obtain a patched version that properly sanitizes or escapes shell metacharacters before command approval. Interim workarounds pending patch deployment include: implementing input validation at the network level to reject commands containing shell substitution syntax ($(...), backticks), running Ridvay Code with restricted privileges (non-root user) to limit RCE impact, and disabling the auto-approval feature entirely in favor of explicit manual approval for critical commands. Contact the vendor or monitor their security advisories at https://github.com/Secsys-FDU/LLM-Tool-Calling-CVEs/issues/8 for patch release timelines.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-78 – OS Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today