PentAGI EUVD-2026-52222

The vulnerability is remotely exploitable with no authentication required (PR:N, AV:N per CVSS 4.0), but requires high attack complexity (AC:H) - the attacker must craft a precise manipulation of inputs processed by the Tool Management Protocol Handler in the pentester prompt template. Exploitation is conditioned on: (1) the PentAGI instance being network-accessible, as the attack vector is network; (2) the Tool Management Protocol Handler being active and processing external or attacker-influenced input - if the handler only processes internally generated tool calls, external exploitation may be constrained. What limits exploitation: the high complexity requirement means generic scanning tools are unlikely to succeed; the vendor's non-response suggests no internal mitigations have been deployed; and the low CIA impact (VC:L/VI:L/VA:L) bounds the blast radius to partial disclosure or limited manipulation rather than full system compromise. Non-default configurations are not explicitly required - the vulnerability appears to affect standard PentAGI deployments up to 2.1.0.

The CVSS 4.0 score of 6.3 (AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L) reflects a moderate-risk profile: network-accessible and requiring no credentials, but gated behind high attack complexity that substantially limits opportunistic exploitation. The E:P supplemental metric confirms a publicly available proof-of-concept. There is no CISA KEV listing, meaning active exploitation in the wild is not currently confirmed - distinguishing this from an emergency-tier issue. EPSS data was not provided, so probabilistic exploitation rate cannot be quoted. Real-world risk is meaningfully tempered by: (1) high attack complexity requiring sophisticated crafted inputs, (2) only low-level impact across CIA triad on the vulnerable system, and (3) the niche deployment footprint of an AI pentesting framework versus commodity infrastructure. However, the combination of a public exploit, an unresponsive vendor, and no patch raises the residual risk - defenders cannot rely on a forthcoming fix and must apply compensating controls immediately. The tag 'Information Disclosure' suggests the most realistic impact is leakage of data accessible to the AI agent's tool context.

An attacker with network access to a PentAGI deployment crafts a specially constructed input targeting the Tool Management Protocol Handler, leveraging the published proof-of-concept at https://github.com/ez-lbz/pentagi-vul-report. The crafted payload manipulates the pentester.tmpl template processing logic to exceed sandbox privilege boundaries, potentially causing the AI agent to access or disclose information outside its intended scope. The high attack complexity means successful exploitation requires precise understanding of the template handling internals, limiting this to skilled or research-grade attackers rather than script-kiddie opportunism.