Is there a patch available for EUVD-2026-21768?

Yes, a patch is available for EUVD-2026-21768. Update the affected software to the latest version immediately.

Personal Ai Infrastructure EUVD-2026-21768

Q: What is the CVSS score of EUVD-2026-21768?

EUVD-2026-21768 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.7%.

| CVE-2026-6141 LOW

OS Command Injection (CWE-78)

2026-04-13 VulDB

Command Injection Personal Ai Infrastructure

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.3 (MEDIUM) 2.1 (LOW)

CVSS changed

Apr 13, 2026 - 01:22 NVD

6.3 (MEDIUM) 5.3 (MEDIUM)

Analysis Generated

Apr 13, 2026 - 01:18 vuln.today

EUVD ID Assigned

Apr 13, 2026 - 01:15 euvd

EUVD-2026-21768

Analysis Generated

Apr 13, 2026 - 01:15 vuln.today

Patch released

Apr 13, 2026 - 01:15 nvd

Patch available

CVE Published

Apr 13, 2026 - 00:45 nvd

LOW 2.1

DescriptionCVE.org

A vulnerability was determined in danielmiessler Personal_AI_Infrastructure up to 2.3.0. Affected is an unknown function of the file Skills/Parser/Tools/parse_url.ts. Executing a manipulation can lead to os command injection. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. This patch is called 14322e87e58bf585cf3c7b9295578a6eb7dc4945. It is advisable to implement a patch to correct this issue. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

AnalysisAI

OS command injection in danielmiessler Personal_AI_Infrastructure up to version 2.3.0 allows authenticated remote attackers to execute arbitrary system commands via a malicious URL parameter in the parse_url.ts parser tool. The vulnerability requires low-privilege authentication and has publicly available exploit code; the vendor released a patched version promptly after disclosure.

Technical ContextAI

The vulnerability exists in the URL parsing functionality (Skills/Parser/Tools/parse_url.ts) within Personal_AI_Infrastructure, a TypeScript-based AI infrastructure tool. The root cause is improper input validation and sanitization of URL parameters before passing them to OS command execution functions, classified as CWE-78 (OS Command Injection). The parse_url module fails to escape or validate user-supplied input, allowing attackers with authenticated access to inject shell metacharacters that are then interpreted by the underlying operating system when the URL is processed, enabling arbitrary command execution with the privileges of the application process.

RemediationAI

Upgrade to the patched version released by the vendor following the disclosure and merge of pull request #659. The exact patched release version is not independently named in the provided data, but the fix commit (14322e87e58bf585cf3c7b9295578a6eb7dc4945) is available in the main repository. Users should pull the latest version from the official GitHub repository (https://github.com/danielmiessler/Personal_AI_Infrastructure) where the commit has been merged. As a temporary workaround pending upgrade, restrict authenticated access to trusted users only and audit parse_url function calls for suspicious URL parameters.