EUVD-2026-90422
GHSA-6r9c-47f4-cxxx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach prompt-influenced agent input
-
DeliveryDeliver prompt-injection payload
-
ExploitAgent invokes shell_exec without approval
-
ExecutionExecute arbitrary host commands
-
ImpactFull host compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Code injection prevention, sandbox exec
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the camel-ai agent to be deployed with the TerminalToolkit (shell_exec capability) enabled, and the attacker to be able to influence the agent's prompt - either as a direct interactive user or via indirect prompt injection in content the agent ingests. The defining condition from the description is the absence of any approval/confirmation boundary before shell_exec runs, so once a malicious instruction reaches the agent, commands execute without human gating. Limiting factors: affected only in versions 0.2.91a1, 0.2.91a2, and 0.2.91a3; deployments that do not enable the terminal toolkit, that sandbox command execution, or that add a human-approval step are not exploitable; impact is bounded by the privileges of the agent process. |
| Impact | Signals are mixed and point to elevated but not emergency-tier priority. The NVD CVSS vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H = 9.8 Critical) and the SSVC decision (Technical Impact: total, Automatable: yes, Exploitation: poc) both argue for a severe, fully-compromising flaw. However, EPSS is only 0.25% (15th percentile), indicating low modeled probability of broad near-term exploitation, and the CVE is NOT on CISA KEV, so there is no evidence of active exploitation - only publicly available proof-of-concept code (the referenced gist). There is tension between the 9.8 'network/no-privileges/no-interaction' scoring and the actual nature of the bug: this is a missing approval boundary in an LLM agent's TerminalToolkit.shell_exec, so real-world exploitation is gated on the affected product being deployed with that terminal toolkit enabled AND an attacker being able to steer the agent's prompt (directly or via indirect prompt injection). The CVSS treats this as unauthenticated remote because the agent itself executes commands, but that masks the configuration/exposure prerequisites - verify deployment context before treating as universally remotely exploitable. Net: a genuine RCE-class issue worth prompt patching for anyone running the affected alpha builds with terminal tooling, but the low EPSS, absence of KEV, and early-alpha affected versions suggest targeted/opportunistic rather than widespread exploitation risk. |
| Exploit ScenarioDerived | An application built on camel-ai 0.2.91a1-a3 exposes an agent that uses TerminalToolkit and processes attacker-influenced input (e.g., a chat message or fetched web/document content). Because shell_exec has no approval boundary, a crafted prompt - including indirect prompt-injection payloads embedded in data the agent reads - causes the agent to execute arbitrary shell commands on the host with the agent process's privileges. Public proof-of-concept code exists (referenced gist), lowering the barrier to reproduction. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 02, 2026
Prompt-driven shell command execution in camel-ai CAMEL 0.2.91a1, 0.2.91a2 and 0.2.91a3 lets anyone who can influence an agent's prompt - directly as an interactive user or indirectly through content the agent ingests - run arbitrary operating-system commands, because TerminalToolkit.shell_exec performs no approval or confirmation step before executing. The independent assessment rates this high (AV:N/AC:H/PR:N/UI:N, C/I/A:H) because the agent must be deployed with the terminal toolkit enabled, whereas the unadjusted NVD vector of 9.8 assumes no such precondition; the attacker is unauthenticated per the vector (PR:N), though exploitation depends on prompt influence. Publicly available exploit code exists (a proof-of-concept gist is linked from the advisory), but there is no confirmed actively exploited status (CISA KEV), and EPSS is low at 0.25 percent (15th percentile), making this an elevated but not emergency-tier priority.
RemediationAI
No vendor-released patch has been identified at time of analysis - no fixed version number is given in the CVE description, the EUVD record, or any of the linked references, and the upstream issue link (https://github.com/camel-ai/camel/issues/4038) should be monitored for an official fix rather than assumed to contain one. Until a patched release is confirmed, the most effective control is to remove TerminalToolkit from every enabled toolkit list so shell_exec is never exposed to the model; the trade-off is loss of terminal automation for legitimate agent workflows, which can be partially restored by replacing it with a narrowly scoped, allow-listed tool. Second, add a human-in-the-loop confirmation step in front of any remaining shell execution, requiring explicit operator approval of the exact command string, accepting the cost of interactive latency and the risk of approval fatigue. Third, run the agent process inside a hardened sandbox - a container or VM with a read-only or tightly scoped filesystem, no host socket mounts, dropped Linux capabilities, a non-privileged user, and egress network filtering - so that a successful injection is bounded by the process's (reduced) privileges; this does not stop the injection itself and can break agents that legitimately need broad filesystem or network access. Fourth, reduce the prompt-injection attack surface by treating all ingested content (web fetches, documents, tool outputs, third-party messages) as untrusted and refusing to let it flow into tool arguments without sanitization, and by disabling automatic ingestion of external content in agent pipelines. Finally, log and alert on every shell_exec invocation so any successful prompt-injection attempt is detected quickly, since detection is the only remaining layer once execution has occurred.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CAMEL is an open-source multi-agent framework in which large language model agents are given 'toolkits' - callable functions that extend what the model can do. TerminalToolkit exposes shell_exec, which passes a model-generated string to the host shell. The root cause class is CWE-94 (improper control of generation of code / code injection): untrusted natural-language input is converted into an executable command without validation, sanitization, or any human-in-the-loop approval gate. Because the boundary between 'model instruction' and 'operating-system command' is absent, ordinary prompt-injection techniques - a crafted user turn, or malicious text embedded in a document, web page, or tool output the agent reads - are sufficient to steer shell_exec. The CPE supplied with the record is a placeholder (n/a), so scoping must be taken from the description instead: only the alpha releases v0.2.91a1, v0.2.91a2 and v0.2.91a3 of camel-ai camel are identified as affected. The practical impact ceiling is the privilege set of the agent process, which in typical deployments is an unsandboxed developer or service account.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable prompt path with no auth (PR:N) but AC:H because it depends on TerminalToolkit being enabled and an attacker-controllable prompt-injection path; full host impact so C/I/A:H.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
In camel-ai camel 0.2.91a1, v0.2.91a2 and v0.2.91a3, TerminalToolkit.shell_exec allows prompt-driven shell command execution without an approval boundary.
Executive ViewAI
CAMEL AI's agent framework versions 0.2.91a1 through 0.2.91a3, when deployed with the terminal toolkit enabled, allow unauthenticated attackers to execute arbitrary operating-system commands through prompt influence. This exposes organizations using these versions to full compromise of agent host systems, impacting data confidentiality, integrity, and availability. While publicly available exploit code exists and no vendor-released patch is identified at time of analysis, there is no confirmed active exploitation and exploitation requires the terminal toolkit to be enabled, making this a high but not emergency-tier priority.
No vendor-released patch identified at time of analysis. Interim mitigations: disable or remove TerminalToolkit.shell_exec; run agents in isolated sandboxes with no host shell access; require manual approval for command execution; sanitize and validate all prompts and ingested content; restrict network egress from agent hosts; monitor logs for anomalous command execution.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB