EUVD-2026-90423
GHSA-q2f7-8vfc-xg45
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach agent using CodeExecutionToolkit
-
DeliveryInject prompt steering model to emit Python
-
ExploitModel-generated code passed to SubprocessInterpreter
-
ExecutionCode runs without approval boundary
-
ImpactArbitrary command execution on host
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Code injection prevention, sandbox exec
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the host application to use camel-ai's CodeExecutionToolkit backed by SubprocessInterpreter and to route attacker-influenceable input to that agent; the attacker must be able to steer model output (e.g., via prompt/task injection) so it produces executable Python, which then runs with no approval or confirmation step. Limited to versions 0.2.91a1, 0.2.91a2, and 0.2.91a3. The key limiting factor is that code execution is an opt-in toolkit feature, not a default - applications that do not enable CodeExecutionToolkit or that gate code execution behind their own approval boundary are not exposed; realistic risk therefore depends on whether untrusted input can reach a code-executing agent. |
| Impact | The raw signals conflict and must be weighed carefully. The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H = 9.8 Critical) describes unauthenticated remote code execution, but this score overstates practical exploitability: the flaw is a missing approval boundary in camel-ai's CodeExecutionToolkit, which by design executes model-produced Python via SubprocessInterpreter. Exploitation therefore requires (a) the host application to actually enable and wire CodeExecutionToolkit into an agent and (b) an attacker to influence model output (typically via prompt injection) so it emits malicious code. These are real deployment preconditions that the CVSS vector does not reflect - verify whether the AV:N/PR:N characterization matches your integration before treating it as drive-by RCE. Supporting signals point to lower urgency: EPSS is only 0.22% (11th percentile), the CVE is NOT in CISA KEV (no confirmed active exploitation), and no SSVC decision data was provided. A public gist reference suggests exploit/PoC material exists, but PoC availability is distinct from active exploitation. Net: this is a legitimately severe code-execution weakness in affected versions, but it is a condition-dependent design flaw in a developer framework, not a widely-exploited internet-facing CVE - prioritize if you run camel-ai 0.2.91a1-a3 with code execution enabled, otherwise treat as medium real-world risk despite the 9.8 label. |
| Exploit ScenarioDerived | An application built on camel-ai (versions 0.2.91a1-a3) exposes an agent that uses CodeExecutionToolkit to a user-facing or network input channel. An attacker submits a crafted prompt or task that steers the model into generating malicious Python, which SubprocessInterpreter then runs with no approval gate, yielding arbitrary command execution on the host. A public gist referenced in the advisory appears to contain proof-of-concept material demonstrating the missing approval boundary. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 02, 2026
Code execution in camel-ai's CodeExecutionToolkit (versions 0.2.91a1, 0.2.91a2, and 0.2.91a3) lets remote, unauthenticated attackers run arbitrary Python through the SubprocessInterpreter with no approval or confirmation boundary. The attacker must be able to influence the agent's model output - for example via prompt or task injection - so that the LLM emits executable Python, and the host application must have opted into the code-execution toolkit and routed untrusted input to it; exposure is therefore conditional rather than default, which is reflected in the independent assessment's High attack complexity (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) versus the vendor's 9.8 AV:N/AC:L rating. Risk weighting is tempered by a low EPSS of 0.22% (11th percentile), no CISA KEV listing, and no vendor-released patch identified at time of analysis, though a public GitHub issue and a third-party gist describing the flaw are referenced.
RemediationAI
No vendor-released patch identified at time of analysis, so remediation is configuration- and architecture-based rather than version-based; do not assume a later release is fixed without validating the upstream issue at https://github.com/camel-ai/camel/issues/4037 and the repository's release notes, and treat the 0.2.91a1/a2/a3 pre-releases as unsupported for code-executing workloads. The most direct compensating control is to stop using CodeExecutionToolkit with SubprocessInterpreter in any agent path that can receive untrusted input - confirm whether the toolkit is registered in your agent definitions and remove or gate it, accepting the loss of code-execution capability as the trade-off. If code execution is required, replace the local subprocess backend with a containerized or otherwise isolated interpreter that has no host filesystem mounts, no credentials or environment secrets, and no unrestricted outbound network access; note that heavy sandboxing degrades some execution fidelity (dependency availability, filesystem persistence) and must be tested against your workloads. Add an application-level approval or allow-list gate in front of any code-executing tool call - requiring explicit human confirmation, a safe-API allow-list, or static analysis of generated code before dispatch - which reduces autonomy and adds latency but restores a trust boundary; combine this with prompt-input sanitation and provenance checks on any content reaching the agent to blunt prompt/task injection, while recognizing that LLM input filtering is bypassable and should not be the sole control. Finally, monitor for anomalous child-process creation and unexpected Python interpreter spawns from the host application as a detective measure, and restrict the privileges of the service account running agents to limit blast radius if the toolkit is reached.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
camel-ai (CAMEL) is an open-source multi-agent LLM framework; its CodeExecutionToolkit is an agent tool that takes code generated by a language model and executes it. In the affected pre-release versions the toolkit's SubprocessInterpreter path invokes model-produced Python directly in a local subprocess without any approval boundary, human-in-the-loop confirmation, or policy gate - the root cause class is CWE-94 (Improper Control of Generation of Code / Code Injection), where untrusted, model-generated text is treated as trusted executable input. The security-relevant abstraction is the trust boundary between the LLM's output and the host operating system: because the model's output is steerable by whatever content reaches the agent (user prompts, retrieved documents, tool results, or task instructions), any channel that lets an attacker shape the model's response can be escalated into operating-system command and code execution in the process running the interpreter. Authentication is not required per the CVSS vector (PR:N), but the practical precondition is control over agent input plus an application configuration that enables CodeExecutionToolkit with SubprocessInterpreter. CPE data supplied with this CVE is unpopulated (all fields 'n/a'), so affected-product identification rests on the vendor version strings (0.2.91a1/a2/a3) and the referenced upstream advisory material rather than on authoritative CPE enumeration.
Know when Python gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
AV:N as input may arrive over network, but AC:H because exploitation depends on the app enabling CodeExecutionToolkit and attacker steering model output; full host-level C/I/A impact via arbitrary code execution.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
In camel-ai camel 0.2.91a1, v0.2.91a2 and v0.2.91a3, CodeExecutionToolkit can run model-produced Python code through SubprocessInterpreter without an approval boundary.
Executive ViewAI
Camel-ai's CodeExecutionToolkit in versions 0.2.91a1, 0.2.91a2, and 0.2.91a3 creates a critical remote code execution exposure when the toolkit is enabled and untrusted input can influence model output, potentially allowing unauthenticated attackers to run arbitrary Python on the host. Exploitation is conditional on specific agent integration and routing choices, but a successful attack could compromise the confidentiality, integrity, and availability of AI agent infrastructure and connected data. Leadership should prioritize inventory and containment because no vendor-released patch is available and the issue is rated critical.
No vendor-released patch identified at time of analysis; disable or remove the CodeExecutionToolkit in camel-ai 0.2.91a1, 0.2.91a2, and 0.2.91a3, enforce human approval for code execution, sandbox the SubprocessInterpreter with least privilege and no network or secret access, restrict untrusted input to agents, and monitor for unauthorized Python execution.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution affects Kestra OSS (the open-source event-driven orchestration platform) prior to
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Exploit-DB