EUVD-2026-25863Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network request to /devserver/start injects OS commands with no user interaction (AV:N/AC:L/PR:N/UI:N), yielding full host code execution (C:H/I:H/A:H).
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
4DescriptionCVE.org
A remote code execution (RCE) vulnerability in the /devserver/start endpoint of leonvanzyl autocoder commit 79d02a allows attackers to execute arbitrary code via providing a crafted command parameter.
AnalysisAI
Command injection in leonvanzyl's autocoder (development snapshot commit 79d02a) lets remote, unauthenticated attackers achieve arbitrary code execution by supplying a crafted 'command' parameter to the /devserver/start endpoint, which passes attacker input to a shell. The CVSS 9.8 score reflects network-reachable, no-authentication exploitation with total confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis, though CISA's SSVC framework rates it as automatable with total technical impact; EPSS is low at 0.27% (50th percentile).
Technical ContextAI
autocoder is an open-source AI code-generation/agent tool distributed via GitHub (github.com/leonvanzyl/autocoder). The flaw is CWE-77 (Improper Neutralization of Special Elements used in a Command - Command Injection): the /devserver/start route accepts a 'command' parameter that is used to start a development server, and that value is concatenated into a shell invocation without sanitization or safe-argument handling. Because the endpoint is designed to launch processes, injected shell metacharacters (e.g. ;, |, &&, backticks, $()) let an attacker run OS commands with the privileges of the autocoder process. The affected build is identified only by source commit 79d02a rather than a tagged release, consistent with a pre-release/hobby development project.
RemediationAI
No vendor-released patch identified at time of analysis, and no fixed version or commit is cited in the provided references. As compensating controls: do not expose the autocoder /devserver/start endpoint to untrusted networks - bind it to localhost/127.0.0.1 only and place it behind authentication or a VPN (trade-off: breaks remote/team access to the dev server). Block or firewall the autocoder listening port at the network edge so the endpoint is unreachable from the internet. If self-building, patch the /devserver/start handler to stop passing the 'command' parameter to a shell - use an allowlist of permitted commands or an exec-style API with argument arrays rather than string concatenation (trade-off: requires code changes and may restrict legitimate custom commands). Run the autocoder process as a low-privilege, sandboxed user to limit blast radius. Monitor the project repository (https://github.com/leonvanzyl/autocoder) for a fixed commit and the referenced gist (https://gist.github.com/syphonetic/e3bdee6c022b36d5ecb98fbf61284931) for exploit details.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-77 – Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today