FinRobot CVE-2026-51918

Exploitation requires that attacker-controlled input reaches the CodingUtils.create_file_with_code() routine of FinRobot 1.0.0 - i.e., a deployment where the agent/orchestrator forwards untrusted text (a malicious prompt, document, or tool/data input) into this code-writing function without neutralization. The limiting factor is reachability: FinRobot is a Python agent framework typically run as a local/orchestrated process, so the 'remote unauthenticated' CVSS rating holds only when an integrator exposes the agent pipeline to external, untrusted input. No special product configuration flag is named in the description, but the practical precondition is an input path from an untrusted source to the vulnerable function; isolated/local-only usage with trusted input materially reduces real risk.

The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H → 9.8 Critical) describes an unauthenticated, network-reachable code-injection flaw (CWE-94) with full confidentiality/integrity/availability impact. However, the other signals pull strongly against treating this as an urgent, broadly-exploitable priority. EPSS is only 0.21% (10th percentile), it is NOT in CISA KEV (no confirmed active exploitation), and no SSVC decision data was provided. There is a clear tension to flag explicitly: the CVSS network/unauthenticated rating is almost certainly optimistic for this target - create_file_with_code() is a code-writing utility inside an AI financial-agent framework (FinRobot), and in typical deployments it is invoked by the local agent/orchestrator on LLM- or operator-supplied input rather than directly over an exposed, unauthenticated network socket. So 'network/unauthenticated' depends entirely on whether an integrator wires this function to untrusted external input; verify the actual exposure surface with the project. The practical priority is MODERATE: critical technical impact (code execution) but low exploitation probability, no KEV listing, and a small, niche deployment footprint. The GitHub issue (#102) and a Gist reference suggest exploit/PoC detail may exist and should be reviewed, but no PoC flag was confirmed in the input.

An attacker who can influence the code/content argument passed to FinRobot's CodingUtils.create_file_with_code() - for example by feeding a malicious prompt or document into an agent workflow that forwards attacker-controlled text into this code-writing routine - injects Python/code that is written and subsequently executed, yielding arbitrary code execution in the host context (CWE-94). A GitHub issue (#102) and a public Gist are referenced and may contain PoC detail, but PoC availability is not confirmed in the provided data. The CVSS AC:L rating implies low complexity once attacker input reaches the vulnerable function.