EUVD-2026-29054
GHSA-m85w-whwh-qvfx
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
AV:L reflects typical local CLI deployment; UI:R reflects the mandatory confirmation prompt; C/I/A:H reflects full arbitrary shell execution potential.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
GPT-Pilot thru commit 0819827ce20346ef5f25b3fe29293cb448840565 (2025-09-03) contains a command injection vulnerability (CWE-78) in the Executor.run() method. During project execution, when the system prompts the user to confirm or modify a command to be run, it accepts free-text input without proper validation. The user-supplied input is directly passed to asyncio.create_subprocess_shell() for execution. This allows an attacker to replace the intended command with arbitrary shell commands, leading to remote code execution with the privileges of the GPT-Pilot process.
AnalysisAI
Command injection in GPT-Pilot's Executor.run() method enables arbitrary shell command execution through the interactive command confirmation workflow, affecting all versions through commit 0819827ce20346ef5f25b3fe29293cb448840565 (2025-09-03). An actor with access to the confirmation prompt - locally or via a network-exposed deployment - can substitute malicious shell commands that are passed unsanitized to asyncio.create_subprocess_shell(), executing with the full privileges of the GPT-Pilot process. No active exploitation has been confirmed (not in CISA KEV), and EPSS at 0.14% (33rd percentile) reflects low current exploitation activity, though the RCE impact class warrants attention in multi-user or network-exposed deployments.
Technical ContextAI
GPT-Pilot is a Python-based AI software development assistant that autonomously generates and executes shell commands to build software. The vulnerable Executor.run() method uses Python's asyncio.create_subprocess_shell() - the async equivalent of subprocess.Popen(shell=True) - to run AI-generated commands. The shell=True mode passes the command string to /bin/sh, which interprets metacharacters (;, &&, |, $(), backticks) as control operators. The interactive confirmation step was designed as a safety gate allowing users to review or modify commands before execution, but because free-text input is concatenated directly into the shell command string without stripping special characters, it becomes the injection vector rather than a safeguard. This matches CWE-78 (Improper Neutralization of Special Elements used in an OS Command) exactly. CPE data in NVD is populated as n/a, so no automated CPE-based version detection is possible; the affected version boundary is defined only by the specific git commit hash.
RemediationAI
The primary fix is to update GPT-Pilot to any commit beyond 0819827ce20346ef5f25b3fe29293cb448840565, once a patched version is confirmed via the repository at https://github.com/Pythagora-io/gpt-pilot or the vendor advisory at https://www.notion.so/CVE-2026-31246-35d1e1393188812ea3c6c88ad28d3d57. No specific patched version or release tag has been confirmed from the available data. If a patch is not yet available, the root fix at the code level is to replace asyncio.create_subprocess_shell() with asyncio.create_subprocess_exec() using pre-tokenized argument lists, which bypasses shell interpretation entirely and eliminates the injection surface. As a compensating control in multi-user or shared deployments, restrict interactive access to the GPT-Pilot process to trusted users only, or disable the free-text command modification feature in the confirmation workflow until patched. Disabling shell=True equivalents eliminates the injection path but requires refactoring command construction logic throughout Executor.run().
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-78 – OS Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today