EUVD-2026-77188
GHSA-34ch-x498-hrhv
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable via SSH target data flow, PR:L for required tool operator positioning; low C/I/A impact consistent with limited blast radius.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability was identified in ipa-lab HackingBuddyGPT up to 0.5.0. This affects the function ssh_run_command of the file src/hackingBuddyGPT/extensions/ssh_run_command.py. Such manipulation leads to os command injection. The attack can be launched remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
OS command injection in HackingBuddyGPT up to version 0.5.0 allows a remote low-privileged attacker to execute arbitrary commands on the host running the tool by manipulating input processed by the ssh_run_command function in src/hackingBuddyGPT/extensions/ssh_run_command.py. The function fails to sanitize shell metacharacters before constructing and executing SSH commands, creating a classic CWE-78 unsanitized-input-to-shell scenario. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) a low-privileged attacker who can interact with or control an SSH endpoint that HackingBuddyGPT is actively auditing - this includes a malicious target server, a MITM position on the SSH session, or control over any data source the LLM uses to generate commands; (2) the tool must be running in a mode that invokes `ssh_run_command` against attacker-controlled input; (3) the victim operator must have HackingBuddyGPT version ≤ 0.5.0 installed. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N, score 5.3) correctly reflects a moderate-severity issue: low-complexity network-reachable exploitation, but constrained to low impact across all dimensions (VC:L/VI:L/VA:L) with no subsequent-system scope change. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch has been identified at time of analysis. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today