EUVD-2026-90413
GHSA-23c2-f3h2-xmcw
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed DeepTutor agent endpoint
-
DeliverySubmit crafted input to agent
-
ExploitInjection reaches ExecTool.execute shell call
-
ExecutionArbitrary OS command runs on host
-
ImpactFull host compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a running, network-reachable DeepTutor v1.4.0 instance whose agent accepts attacker-influenced input that is passed into the ExecTool.execute shell-command tool in /tutorbot/agent/tools/shell.py. The CVSS vector (PR:N/UI:N) implies no authentication or user interaction is needed, but authentication requirements for the agent endpoint are not explicitly confirmed from the available data and should be verified against the actual deployment. The primary limiting factor is exposure: the specific DeepTutor version must be deployed and its agent interface reachable by the attacker, which - given the product's niche, self-hosted nature - sharply constrains the realistic target population. |
| Impact | Signals are mixed and point to a serious-but-niche issue. The NVD CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H, base 9.8) describes a maximally severe, remotely reachable, unauthenticated OS command injection (CWE-78) in DeepTutor v1.4.0's agent shell tool - technically a full-compromise RCE. However, the EPSS score is only 0.25% (15th percentile), indicating low modeled probability of near-term broad exploitation, and the vulnerability is NOT in CISA KEV (no confirmed active exploitation). The apparent presence of a public gist alongside the GitHub issue suggests publicly available exploit/PoC code, which raises practical risk, but PoC availability is a distinct signal from active exploitation and should not be conflated with it. No SSVC decision data was provided in the input. Net: the high CVSS reflects genuine technical impact, but the real-world priority is tempered by the product's very small deployment footprint and the absence of KEV/high-EPSS evidence - this is better characterized as a critical flaw in a niche open-source project than a widespread emergency. One caveat to verify: PR:N assumes the DeepTutor agent endpoint is exposed without authentication, which the description does not explicitly confirm. |
| Exploit ScenarioDerived | An attacker interacts with a reachable DeepTutor v1.4.0 agent and supplies crafted input that flows into the ExecTool.execute shell routine in /tutorbot/agent/tools/shell.py, injecting attacker-controlled OS commands that execute on the host. Because the CVSS vector is network, low-complexity, and requires no privileges or user interaction, a single malicious request can yield arbitrary command execution. A referenced public gist appears to document the technique, lowering the barrier to weaponization. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 01, 2026
Command injection in DeepTutor 1.4.0 allows remote attackers to execute arbitrary shell commands through the ExecTool.execute function in /tutorbot/agent/tools/shell.py. The provided CVSS vector rates this 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), implying no authentication or user interaction is required, though authentication requirements for the agent endpoint are not explicitly confirmed from the available data and should be verified against the actual deployment. Exploitation is not confirmed as active (no CISA KEV listing) and no public exploit code was identified at time of analysis, and EPSS is low at 0.25% (15th percentile), reflecting that impact depends on a network-reachable instance of this niche, self-hosted product.
RemediationAI
No vendor-released patch was identified at time of analysis for CVE-2026-51870, so remediation must lean on compensating controls while tracking the upstream issue at https://github.com/HKUDS/DeepTutor/issues/506 for a fixed release. Primary hardening: disable or remove the ExecTool shell-execution capability in the agent configuration (or the /tutorbot/agent/tools/shell.py tool registration) if the tutoring workflow can operate without shell access - the trade-off is loss of any legitimate agent functionality that depends on command execution. Second, do not expose the DeepTutor agent endpoint to untrusted networks: bind it to localhost or a private interface and place it behind an authenticating reverse proxy, since the CVSS vector implies PR:N but endpoint authentication is unconfirmed - the trade-off is that remote or multi-user access requires additional access-management plumbing. Third, run DeepTutor as an unprivileged dedicated user inside a container with no host filesystem mounts, a read-only root where possible, dropped Linux capabilities, and restricted outbound egress (allowlist only required package registries/model APIs) - this limits blast radius and data exfiltration but may break legitimate agent integrations. Fourth, treat all agent input as untrusted and, where shell execution cannot be disabled, wrap ExecTool with a strict command allowlist and argument validation rather than shell interpolation; such wrappers are brittle and are not a substitute for the upstream fix. Monitor the DeepTutor repository and the NVD/EUVD entries for a patched 1.4.x or later release and upgrade as soon as it is published.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is DeepTutor's agent tool layer, specifically ExecTool.execute at path /tutorbot/agent/tools/shell.py. ExecTool is a shell-command execution tool exposed to the tutoring agent's tool-calling loop, so any attacker-influenced text that reaches this tool - user prompts, uploaded content, retrieved documents, or chained tool output - can be turned into an operating-system command. This maps to CWE-78 (Improper Neutralization of Special Elements used in an OS Command, i.e., OS command injection): the root cause class is missing or insufficient sanitization/escaping, or reliance on a shell invocation, before the value is passed to the command interpreter. The underlying risk pattern is common to LLM/agent frameworks that grant models raw shell access: the trust boundary between untrusted model/agent input and the host shell is not enforced. The CPE supplied with this record is uninformative (cpe:2.3:a:n/a:n/a:*:*:*:*:*:*:*:*), and the ENISA EUVD record (EUVD-2026-90413) likewise lists affected versions as n/a, so version scope must be taken from the description as DeepTutor v1.4.0.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
OS command injection into a shell tool yields full host RCE; AV:N/AC:L for a network-reachable agent, PR:N/UI:N assuming an unauthenticated exposed endpoint, so C/I/A:H.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
DeepTutor v1.4.0 is vulnerable to command execution in /tutorbot/agent/tools/shell.py:ExecTool.execute.
Executive ViewAI
A critical command injection flaw in DeepTutor 1.4.0 allows unauthenticated attackers who can reach the product's agent service over the network to run arbitrary shell commands on the host. Because no vendor patch is currently available, any internet- or intranet-exposed DeepTutor deployment is a potential entry point for full system compromise, data theft, or use as a pivot into adjacent systems. Leadership should treat this as a contained but urgent exposure limited to teams running this niche self-hosted tool, and prioritize identifying and isolating those instances before a working exploit emerges.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict network reachability of the agent endpoint to trusted hosts only (firewall/security group/reverse-proxy allowlists); disable or remove the ExecTool shell-execution capability if configuration permits; run DeepTutor as a non-privileged, isolated container or VM in a segmented subnet with strict outbound egress filtering; enforce authentication at the reverse proxy in front of the agent endpoint; deploy WAF/IDS rules targeting shell metacharacter injection; and monitor host process creation and outbound connections for signs of command execution or exfiltration.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Exploit-DB