aandrew-me tgpt CVE-2026-8210

Local authenticated user access to the system running aandrew-me tgpt is required. The attacker must have a valid user account on the Linux or macOS machine and must be able to invoke or trigger the Update Handler function in helper.go through the application's interface or API. No special configuration or non-default settings are mentioned in the vulnerability description; the vulnerability exists in the default code path of the Update Handler. Exploitation is blocked only by the requirement for local file system access and user authentication; network-based remote exploitation is not possible due to the local-only attack vector. The vulnerability does not cross privilege boundaries (scope not changed, SC:N), meaning the attacker's capabilities are limited to what their own user context permits, though this still enables command injection within that context.

Despite the CVSS v4.0 score of 1.9, which appears extremely low, several factors warrant closer evaluation. The attack vector is local (AV:L) with low complexity (AC:L), requiring low privilege (PR:L) and no user interaction (UI:N), making exploitation straightforward for any authenticated local user. However, the confidentiality, integrity, and availability impacts are all marked as low (VC:L, VI:L, VA:L), and scope is not crossed (SC:N). The CVSS impact is intentionally constrained, likely because the vulnerability requires local access and affects only the current user's context. The exploitation proof-of-concept status (E:P) indicates public availability. Real-world risk is contextual: in shared hosting, containers, or multi-tenant environments where local user accounts exist, this becomes a privilege escalation or lateral movement vector. In single-user or tightly controlled deployments, risk is minimal. The vendor's non-response to early disclosure is a significant concern for patch availability and indicates this may remain unpatched in upstream for an extended period. The low CVSS score should not lead to dismissal; organizations with multi-user systems running tgpt should prioritize mitigation despite the numerical rating.

An authenticated local user on a Linux or macOS system running aandrew-me tgpt invokes or triggers the update function through the application's interface. The attacker crafts input containing shell metacharacters (e.g., semicolons, pipes, command substitution syntax) that are not properly sanitized by the helper.Update function. The malicious payload is passed directly to a system command execution call, allowing the attacker to execute arbitrary commands with the privileges of the user running tgpt. The attacker gains the ability to read files, modify configurations, or escalate privileges depending on the tgpt process permissions.