EUVD-2026-91124
GHSA-33xc-p62q-whgp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed tutorbot WebSocket
-
DeliverySend crafted tool-invoking message
-
ExploitInject command into ExecTool.execute
-
ExecutionShell command runs in service environment
-
ImpactFull RCE and data compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Code injection prevention, sandbox exec
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a running DeepTutor 1.4.0 instance whose live tutorbot WebSocket interface is network-reachable by the attacker, with the agent tool layer (ExecTool) enabled so that caller-supplied input can reach ExecTool.execute. No authentication or user interaction is required per the CVSS vector (PR:N/UI:N), so against such an exposed, default-configured service this is remote unauthenticated RCE. The primary limiting factor is deployment and exposure: the tutorbot WebSocket must be accessible (not firewalled/localhost-only), the service must run the tool-execution path, and only DeepTutor 1.4.0 (the sole version named) is confirmed affected - no vendor-confirmed version range is available. |
| Impact | The CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects unauthenticated, network-reachable code injection (CWE-94) yielding full confidentiality, integrity, and availability loss - on paper, a maximum-urgency flaw. However, the signals conflict on real-world priority. EPSS is only 0.16% (4th percentile), indicating very low modeled probability of broad exploitation in the near term, and the vulnerability is NOT in CISA KEV, so there is no evidence of active exploitation. One of the two cveorg references is a public gist (gist.github.com/Ro1ME/...) that appears to be proof-of-concept exploit material published alongside the upstream GitHub issue, so publicly available exploit code likely exists - this raises practical risk above what EPSS alone suggests, but PoC availability is a distinct signal from active exploitation and must not be conflated with it. No SSVC decision data was provided. The net picture: technically trivial-to-exploit RCE with likely public PoC, but affecting an obscure open-source AI-tutor project with negligible deployment footprint, so the low EPSS/absent-KEV combination is consistent with a genuinely low-prevalence target rather than a widespread threat. Priority is high for any organization actually running DeepTutor 1.4.0 with an exposed tutorbot WebSocket, and low for everyone else. |
| Exploit ScenarioDerived | An attacker reaches the live tutorbot WebSocket interface of an exposed DeepTutor 1.4.0 instance and sends input crafted so the agent/tool layer routes attacker-controlled text into ExecTool.execute, which runs it as a shell command in the service environment. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, this requires only network reachability with no authentication or user interaction, and a public gist appears to provide working proof-of-concept exploit code. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 06, 2026
Remote unauthenticated code execution in DeepTutor 1.4.0 lets any network caller who can reach the live tutorbot WebSocket interface drive the agent tool layer into running reviewer-chosen shell commands inside the service environment, yielding full confidentiality, integrity and availability impact (CVSS 3.1 base 9.8, AV:N/AC:L/PR:N/UI:N). The underlying defect is a CWE-94 code-injection weakness in ExecTool.execute, and successful exploitation depends entirely on the deployment: the tutorbot WebSocket endpoint must be network-reachable rather than localhost-only or firewalled, and the tool-execution path must be enabled so caller-supplied input reaches ExecTool.execute. This is not in CISA KEV and no public exploit code was identified at time of analysis, while EPSS is very low at 0.16% (4th percentile), meaning mass opportunistic scanning is unlikely even though the consequence for an exposed, default-configured instance is maximum-severity remote code execution.
RemediationAI
No vendor-released patch identified at time of analysis, so remediation must currently be compensating-control driven. First, eliminate the exposure path: bind the live tutorbot WebSocket to localhost or an internal-only interface and firewall it from untrusted networks, since the entire attack surface is remote reachability of that endpoint - this is the highest-value change and breaks exploitation entirely for external attackers. Second, require authentication and authorization in front of the WebSocket (reverse proxy with mTLS or session auth) rather than relying on the service's own defaults, accepting the added integration and operational overhead. Third, disable the ExecTool tool-execution path, or run the agent in a restricted mode that does not invoke shell execution for caller-supplied input; the trade-off is loss of any legitimate tool/command functionality the tutorbot relies on. Fourth, run DeepTutor under an unprivileged, containerized identity with a read-only filesystem, no host mounts and restricted egress, so that if execution is achieved the blast radius is limited to that sandbox rather than the host. Monitor the upstream repository issue at https://github.com/HKUDS/DeepTutor/issues/518 and the NVD record at https://nvd.nist.gov/vuln/detail/CVE-2026-51881 for a fixed release, and upgrade as soon as a vendor-patched version is published. Note that EPSS is only 0.16% (4th percentile) and there is no confirmed active exploitation, so prioritization should be driven by whether the WebSocket is internet-reachable rather than by mass-exploitation pressure.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
DeepTutor is an agent-style tutoring service that exposes a live tutorbot over a WebSocket interface; messages received on that socket are handed to an agent tool layer, where ExecTool.execute performs the actual command execution. The vulnerability class is CWE-94 (improper control of generation of code / code injection): input supplied by a remote caller is not neutralized before it reaches the execution primitive, so the caller effectively chooses the shell commands the tool layer runs in the service environment. Because the assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U, this is unauthenticated and requires no user interaction, with no scope change - the compromise is confined to the DeepTutor service's own security authority, but that authority is the service's operating environment. The trust boundary that fails is the assumption that content arriving over the live tutorbot WebSocket is reviewer-controlled rather than attacker-controlled. Product identification is weakened by the CPE data: the supplied CPE (cpe:2.3:a:n/a:n/a) is a placeholder with no vendor or product token, and ENISA EUVD likewise lists "n/a n/a" affected versions, so affected-product scoping rests solely on the CVE description naming DeepTutor 1.4.0 and the upstream GitHub issue HKUDS/DeepTutor#518.
Know when Deeptutor gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Remote WebSocket-reachable command injection needs no auth or interaction (AV:N/AC:L/PR:N/UI:N) and yields arbitrary shell execution, giving full C:H/I:H/A:H; S:U as impact stays within the service's authority.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
deeptutor 1.4.0 contains code injection in ExecTool.execute. Through the live tutorbot WebSocket interface, a remote caller can induce the tool layer to execute reviewer-chosen shell commands in the service environment.
Executive ViewAI
DeepTutor 1.4.0 contains a critical remote code execution vulnerability in its tutorbot WebSocket interface that, if exposed, allows an unauthenticated attacker to execute arbitrary shell commands, potentially compromising the entire service environment. Organizations running this version with network-accessible WebSocket endpoints and enabled tool execution should treat this as a high-priority risk, as successful exploitation could lead to full loss of confidentiality, integrity, and availability. While no public exploit identified at time of analysis and no confirmed active exploitation, the potential impact remains high, and leadership should ensure immediate exposure assessment and mitigation to prevent potential business disruption.
Interim mitigations include restricting network access to the tutorbot WebSocket interface (e.g., firewall rules to allow only trusted hosts, binding to localhost if possible), disabling the tool-execution path if not required for business operations, and monitoring service logs for unexpected shell command execution. Apply vendor patch when available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Unauthenticated remote clients can escape the intended bot workspace and write or overwrite arbitrary absolute filesyste
Privilege escalation via missing authorization in HKUDS DeepTutor before 1.4.10 lets any authenticated low-privilege use
Exploit-DB