EUVD-2026-93397
GHSA-w86g-q6vw-5mw6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver crafted Swagger/OpenAPI document
-
DeliveryDeveloper invokes ARCGenAI-Generator
-
ExploitMalicious schema name becomes unsanitized {fileName}
-
ExecutionValue injected into shell cleanup command
-
ImpactArbitrary commands execute on developer host
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a developer to actively invoke the ARCGenAI-Generator (ARCGenAI-Generator.agent.md / prompt) v2.0 on an attacker-controlled Swagger/OpenAPI document. The concrete trigger is an untrusted Swagger schema name that is derived into the {fileName} (and entity-name) value and then interpolated UNQUOTED into the agent's shell-native temporary-file cleanup commands (rm -f / del /Q / rmdir) run via the terminal; shell metacharacters in that name are executed as OS commands (CWE-78). Limiting factors: exploitation is impossible without the developer running the generator against the malicious spec (UI:R), is confined to version 2.0, and only fires during the post-assembly temp-file cleanup step; the fix neutralizes it by enforcing the ^[A-Za-z0-9._-]+$ allowlist, quoting all expansions, and preferring the edit tool's native delete over the shell. Deployments using the patched instructions or whose runtime deletes temp files without a shell are not exploitable. |
| Impact | All signals converge on a genuinely high-severity, developer-targeted code-execution flaw, but the real-world urgency is tempered by the exploitation path. The CVSS 9.6 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) correctly captures that an unauthenticated attacker needs no privileges and low complexity, but the mandatory UI:R is decisive: a developer must actively invoke the ARCGenAI-Generator against an attacker-supplied Swagger/OpenAPI document for the injected shell commands to run. This is not server-side mass exploitation - it is a supply-chain-style attack on developer workstations, so it will not spray across the internet the way a true AV:N/UI:N flaw would. There is no CISA KEV listing and no public exploit identified at time of analysis, and no EPSS score was provided; absence of those is consistent with a newly disclosed, niche developer tool rather than evidence of safety. The source-code diff strongly corroborates the mechanism (unsanitized schema-derived {fileName} interpolated into rm/del cleanup commands), so the technical claim is well-substantiated even though EPSS/KEV/POC telemetry is absent. Net: a real priority for anyone running ARCGenAI-Generator v2.0, but the risk is targeted-and-conditional (requires tricking a developer into processing a malicious spec), not wormable. |
| Exploit ScenarioDerived | An attacker publishes or sends a crafted Swagger/OpenAPI document in which a schema name contains shell metacharacters (e.g. backticks or ;/&& sequences). A developer runs the ARCGenAI-Generator v2.0 against that document; during the temp-file cleanup step the untrusted name is expanded unquoted into shell-native rm/del commands, executing the attacker's arbitrary commands on the developer's machine. No public exploit is identified at time of analysis, but the vendor commit diff fully reveals the injectable code path. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 06, 2026
OS command injection in Progress Software's Autonomous REST Connector GenAI Agents ARCGenAI-Generator 2.0 allows attacker-controlled shell metacharacters embedded in a Swagger/OpenAPI schema name to run as arbitrary OS commands on a developer's workstation, because the derived {fileName} value is interpolated unquoted into the agent's shell-based temporary-file cleanup commands (rm -f / del /Q / rmdir). Exploitation is unauthenticated from a network perspective (CVSS:3.1/AV:N/AC:L/PR:N) but requires user interaction: a developer must load the attacker-supplied API specification into the generator, which is reflected in the UI:R metric and the 9.6 score with Scope:Changed. No public exploit code has been identified at time of analysis and the flaw is not in CISA KEV, but a vendor patch (upstream commit 7ede6d96eb033d647ffdcabf8d8069c098293575 plus the Progress DataDirect Critical Security Alert Bulletin, September 2026) is available.
RemediationAI
Apply the vendor fix: update to the patched ARCGenAI-Generator / ARCGenAI-EntityGen agent and prompt definitions per the Progress DataDirect Critical Security Alert Bulletin (September 2026) at https://community.progress.com/s/article/Progress-DataDirect-Critical-Security-Alert-Bulletin-September-2026-CVE-2026-91140, corresponding to upstream commit 7ede6d96eb033d647ffdcabf8d8069c098293575 (Vendor patch available per advisory; the released, versioned build containing this commit is not independently confirmed from the supplied data). The patch enforces the allowlist '^[A-Za-z0-9._-]+$' on {fileName} and {entity-name}, quotes all shell expansions, and replaces shell-based temporary-file deletion with the editor's native delete operation. Until the patched instructions are deployed, the most effective compensating control is to never invoke the generator against untrusted or third-party Swagger/OpenAPI documents - only use specifications you authored or have reviewed, which removes the attacker-controlled schema-name input entirely (trade-off: eliminates the tool's usefulness for ingesting external APIs). Run the generator inside a disposable, credential-free sandbox or container with no mounted SSH keys, cloud tokens, or source repositories, so that any command execution cannot pivot to developer assets (trade-off: reduced convenience and slower iteration). Do not rely on the agent's runtime to sanitize filenames, since the vulnerable code path performs no such validation before invoking the shell. If your environment permits it, disable or restrict the agent's terminal/shell tool so completion falls back to the file-editing tool's delete capability; note that this may leave stale *.entity.tmp and _header.assembly.tmp artifacts and force manual cleanup. Monitoring developer endpoints for unexpected child processes spawned by the IDE/agent host during generator runs adds detection coverage; there is no evidence of public exploit code or active exploitation at time of analysis, so prioritization should follow the vendor advisory and the 9.6/Scope:Changed rating.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is an agentic AI code-generation workflow defined in GitHub Copilot-style instruction files (.github/agents/ARCGenAI-Generator.agent.md, ARCGenAI-EntityGen.agent.md, and .github/prompts/ARCGenAI-Generator.prompt.md). It consumes an untrusted Swagger/OpenAPI document, derives an output directory name ({fileName}) and per-entity names from the schema, writes intermediate files under ai-output/{fileName}/entities/, and then performs a post-assembly cleanup step using shell-native commands. The patch diff shows that the pre-fix instructions expanded {fileName} unquoted, e.g. 'rm -f ai-output/{fileName}/entities/*.entity.tmp' on POSIX and 'del /Q ai-output\{fileName}\entities\*.entity.tmp' on Windows, and the EntityGen agent likewise wrote to ai-output/{fileName}/entities/{entity-name}.entity.tmp using schema-derived values. This is CWE-78 (Improper Neutralization of Special Elements used in an OS Command): a value derived from untrusted input is passed to a shell without sanitization, so characters such as ;, |, $(), backticks, or & are interpreted by the shell rather than treated as literal path text. The vendor fix addresses the root cause in three ways: it imposes a strict allowlist '^[A-Za-z0-9._-]+$' on both {fileName} and {entity-name} (rejecting path separators, whitespace, and shell metacharacters instead of silently stripping them), it quotes every expansion of {fileName} in the generated shell commands, and it prefers the editing tool's native delete capability over invoking a shell at all so that the injection surface disappears. The change in Scope (S:C) is consistent with command execution escaping the agent's intended file-cleanup context and running in the developer's OS environment.
Know when Autonomous Rest Connector Genai Agents gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Attacker needs no privileges (PR:N) but the developer must run the generator on the crafted spec (UI:R); injection escapes the generator into the host OS shell (S:C) yielding full code execution (C/I/A:H).
Primary rating from Vendor (ProgressSoftware).
CVSS VectorVendor: ProgressSoftware
DescriptionCVE.org
An OS command injection vulnerability in the shell-based temporary-file cleanup instructions in Progress Software Autonomous REST Connector GenAI Agents ARCGenAI-Generator version 2.0 allows an attacker who supplies a crafted Swagger/OpenAPI document to execute arbitrary commands on a developer's machine when a user invokes the generator.
Executive ViewAI
Progress Software's Autonomous REST Connector GenAI Agents (ARCGenAI-Generator 2.0) contains a critical OS command injection flaw that lets an attacker run arbitrary commands on a developer's workstation when that developer loads a malicious OpenAPI/Swagger specification into the generator. Because the tooling sits directly on developer endpoints - likely holding source code, credentials, and access to internal build and deployment systems - a single successful lure could turn one workstation into an entry point for broader lateral movement. Leadership should care because the affected population is small but highly privileged, and the exploitation path runs through ordinary developer workflow rather than a perimeter service.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Exploit-DB