What is the CVSS score of CVE-2026-31236?

CVE-2026-31236 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of llm CLI tool are affected by CVE-2026-31236?

CVE-2026-31236 affects the llm CLI tool through version 0.27.1 and enables arbitrary code execution when users are socially engineered into executing malicious commands.

How to fix or mitigate CVE-2026-31236?

Within 24 hours: inventory all llm CLI tool installations across development and data science teams using 'llm --version' or package managers. Within 7 days: restrict llm CLI usage to trusted, isolated environments and implement mandatory code review processes for any --functions arguments before execution. Within 30 days: monitor vendor advisories for patch availability and prepare deployment plan; alternatively, evaluate replacing llm CLI with alternative tools or implementing application-level sandboxing for command execution.

llm CLI tool CVE-2026-31236

EUVD-2026-29559 CRITICAL

Code Injection (CWE-94)

2026-05-12 mitre

GHSA-g76p-4vg5-f4qh

Python Code Injection RCE N A

9.8

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Red Hat

7.3 HIGH

qualitative

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 14, 2026 - 20:23 vuln.today

CVSS changed

May 14, 2026 - 20:22 NVD

9.8 (CRITICAL)

CVE Published

May 12, 2026 - 00:00 nvd

CRITICAL 9.8

CVE Published

May 12, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

The llm CLI tool thru 0.27.1 contains a critical code injection vulnerability via its --functions command-line argument. This argument is intended to allow users to provide custom Python function definitions. However, the tool directly executes the provided code using the unsafe exec() function without any sanitization, sandboxing, or security restrictions. An attacker can exploit this by crafting a malicious llm command with arbitrary Python code in the --functions argument and using social engineering to trick a victim into running it. This leads to arbitrary code execution on the victim's system, potentially granting the attacker full control.

AnalysisAI

Arbitrary code execution occurs in the llm CLI tool (versions through 0.27.1) when attackers social-engineer victims into running crafted commands containing malicious Python code in the --functions argument. The tool directly executes this code via unsafe exec() without sanitization, enabling full system compromise. CVSS 9.8 assigns network attack vector and no authentication, but real-world exploitation requires local command execution by a tricked user, creating a significant disparity between the vector and actual attack prerequisites. EPSS score of 0.02% (5th percentile) suggests minimal automated exploitation risk, and no active exploitation or public POC has been identified at time of analysis.

Technical ContextAI

The llm CLI tool is a command-line interface for interacting with large language models. The vulnerability stems from CWE-94 (Improper Control of Generation of Code), where the --functions argument accepts user-supplied Python function definitions intended for extending the tool's capabilities. The implementation uses Python's exec() function to evaluate this input directly in the application's runtime context without input validation, AST sanitization, or restricted execution environments (no use of RestrictedPython, sandboxing via subprocess isolation, or capability restrictions). This design flaw allows arbitrary Python code execution with the privileges of the user running the llm command. The CPE data shows 'n/a:n/a', indicating incomplete vendor/product taxonomy in vulnerability databases, though GitHub references confirm the affected product is simonw/llm.

RemediationAI

Upgrade to llm CLI tool version 0.27.2 or later if available, verifying fix status at the official GitHub repository (github.com/simonw/llm) and the vendor's Notion advisory page. As of this analysis, no specific patch version has been independently confirmed from vendor advisories - organizations must monitor the GitHub releases page for security updates. If immediate patching is not feasible, implement these specific compensating controls: (1) Disable or restrict the --functions argument through wrapper scripts that filter this parameter before executing llm commands, noting this breaks legitimate custom function use cases; (2) Educate users never to execute llm commands from untrusted sources including AI-generated suggestions, forum posts, or documentation without manual code review of all arguments; (3) Deploy application control policies (AppLocker, SELinux) to restrict llm execution to approved scripts only, which may reduce workflow flexibility; (4) Run llm commands in isolated containers or VMs with minimal privileges, accepting the operational overhead of containerized workflows. Long-term architectural fix requires the llm project to implement AST-based code validation, restricted execution contexts using Python's compile() with limited builtins, or subprocess isolation for function evaluation.