EUVD-2026-90419
GHSA-4w4g-gc64-8m74
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed bisheng backend
-
DeliverySend crafted request to validate.py
-
ExploitInject attacker-controlled code
-
ExecutionServer evaluates untrusted input
-
ImpactExecute arbitrary code on host
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Code injection prevention, sandbox exec
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a reachable bisheng backend instance running an affected version (2.3.0, 2.4.0, or 2.4.0-beta1) with the validation endpoint in src/backend/bisheng/api/v1/validate.py exposed to the attacker. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, user interaction, or special configuration is stated as required, so a network-exposed default deployment is sufficient. The primary limiting factor is deployment exposure and footprint: bisheng is a self-hosted open-source LLM platform, so risk concentrates on internet-facing or internally reachable instances; no fixed version is confirmed in the available data, so upgrade guidance cannot be pinned to a specific release. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H, base 9.8) describes a textbook remote, unauthenticated, low-complexity code injection (CWE-94) yielding full compromise. However, the real-world signals temper this: EPSS is only 0.21% (10th percentile), the CVE is NOT in CISA KEV, and there is no evidence of active exploitation. A public artifact (a GitHub issue and a gist by researcher Ro1ME) indicates publicly available exploit code exists, which raises practical risk above the low EPSS, but POC availability is distinct from active exploitation. The headline contrast: CVSS says 'critical, trivially exploitable' while EPSS/KEV say 'not yet widely or opportunistically exploited' - consistent with a critical flaw in a product with a small deployment footprint rather than a mass-exploitation event. Note also that the input metadata is degraded: CPE is 'cpe:2.3:a:n/a:n/a' and affected versions in EUVD read 'n/a n/a', so affected-version scope could not be independently confirmed from structured data and must be read from the free-text description (2.3.0, 2.4.0, 2.4.0-beta1). |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends a crafted request to the bisheng backend validation endpoint (src/backend/bisheng/api/v1/validate.py), which evaluates attacker-controlled input as code, resulting in arbitrary code execution on the server. A public proof-of-concept gist and GitHub issue exist, so weaponization effort is minimal. Given AV:N/AC:L/PR:N/UI:N, no user interaction or prior access is required against an exposed instance. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 02, 2026
Code injection in DataElement BiSheng 2.3.0, 2.4.0, and 2.4.0-beta1 allows unauthenticated network attackers to execute arbitrary code and fully compromise affected deployments through the backend validation endpoint src/backend/bisheng/api/v1/validate.py. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H, base 9.8) describes a remote, low-complexity, no-authentication attack that yields complete loss of confidentiality, integrity, and availability. Exploitation is not confirmed as active (not in CISA KEV), no public exploit identified at time of analysis, EPSS is 0.21% (10th percentile), and no fixed version is confirmed in the available data; a GitHub gist referenced in the record may contain further technical detail.
RemediationAI
No vendor-released patch identified at time of analysis for CVE-2026-51861, and no fixed version can be pinned from the available data; track the upstream project (dataelement/bisheng), the GitHub issue https://github.com/dataelement/bisheng/issues/1995, and the NVD/EUVD advisory https://nvd.nist.gov/vuln/detail/CVE-2026-51861 for a release that remediates src/backend/bisheng/api/v1/validate.py. Until an upgrade is available, the most effective compensating control is to remove network reachability to the vulnerable validation endpoint: block external access to the BiSheng backend API by placing it behind a VPN or authenticated reverse proxy, and if the endpoint is not required, disable it or add a reverse-proxy/WAF rule rejecting requests to /api/v1/validate - the trade-off is loss of that functionality for legitimate callers. Because the CVSS vector indicates no authentication is required (PR:N), adding an authentication layer in front of the backend (such as mTLS or an identity-aware proxy) meaningfully raises the bar, at the cost of additional configuration for API clients. Additionally, run BiSheng with least-privilege service accounts and in a container with a read-only filesystem and no host mounts so injected code cannot escalate or persist, and monitor backend logs for abnormal code-evaluation activity; avoid exposing the platform directly to the internet, and consult the gist at https://gist.github.com/Ro1ME/a03814bf661b36823c3ef5e32af93298 for further technical detail useful to detection engineering.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
BiSheng (dataelement/bisheng) is an open-source, self-hosted LLM application development platform with a Python backend that exposes REST API endpoints under src/backend/bisheng/api/v1/. The flaw is CWE-94 (Improper Control of Generation of Code / code injection) in validate.py, where attacker-controlled input is passed into an evaluation or code-execution context rather than being strictly validated, allowing injected code to run with the privileges of the backend service. The provided CPE string is a non-informative placeholder (cpe:2.3:a:n/a:n/a:*:*:*:*:*:*:*:*), so affected inventory must be derived from the stated product versions (2.3.0, 2.4.0, 2.4.0-beta1) and the EUVD record EUVD-2026-90419 rather than from CPE matching. Consistent with the CVSS vector PR:N/UI:N, the endpoint is reachable without authentication or user interaction, so any network-exposed instance of an affected version is a candidate target; the primary gating factor is deployment exposure, since BiSheng is typically self-hosted inside an organization's infrastructure.
Know when Bisheng gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Remote code injection in a network-facing validation endpoint with no stated auth or interaction gives AV:N/AC:L/PR:N/UI:N and full C/I/A impact.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to Code Injection in src/backend/bisheng/api/v1/validate.py.
Executive ViewAI
DataElement's BiSheng platform, specifically versions 2.3.0, 2.4.0, and 2.4.0-beta1, is exposed to a maximum-severity remote code execution flaw that allows an unauthenticated attacker on the network to fully compromise affected systems. With no vendor patch currently available and no credentials or user interaction required, any reachable BiSheng deployment poses an unmitigated risk to the confidentiality, integrity, and availability of organizational data and services. Leadership should treat this as an urgent containment priority while awaiting a vendor fix; no public exploit identified at time of analysis.
No vendor-released patch identified at time of analysis; restrict network access to the backend validation endpoint (src/backend/bisheng/api/v1/validate.py), block untrusted traffic at the perimeter, deploy WAF or virtual patching rules to detect code-injection attempts, segment affected BiSheng deployments from sensitive systems, and monitor logs for anomalous process execution or unauthorized access.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Unauthenticated SSRF in DataElement bisheng through 2.6.0-fix2 exposes internal network services and cloud metadata endp
Remote code execution in BISHENG's workflow engine (versions before 2.6.0) allows any authenticated user to submit craft
Directory traversal in Bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 allows unauthenticated remote attackers to read arbitrary f
Authenticated low-privileged users can read other users' and tenants' extracted document text in Bisheng through 3.0.0-b
Exploit-DB