EUVD-2026-91756
GHSA-rhq5-3cmm-qrj2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach application exposing modify_code
-
DeliverySupply malicious code payload in input
-
ExploitInjected code passed to execution
-
ExecutionArbitrary code runs in host process
-
ImpactCompromise of FinRobot runtime
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Code injection prevention, sandbox exec
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that attacker-controlled input reach the CodingUtils.modify_code function, whose output is executed (CWE-94). This is not a standalone network service: FinRobot is a library/agent framework, so a successful attack depends on the embedding application feeding untrusted data (prompts, agent tasks, or data fields) into modify_code without sanitization. Limiting factors: the vulnerable code path must be exposed to external input by the integrating application, and the target must run FinRobot v1.0.0; there is no evidence of a default network listener, which means the provided AV:N/PR:N rating likely assumes a worst-case integration rather than an out-of-the-box remote service. |
| Impact | Signals are mixed and point to a modest real-world priority despite the 7.3 'High' NVD score. The provided CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N) describes network, unauthenticated, low-complexity exploitation, which inflates the score, yet the impact metrics are only C:L/I:L/A:L - unusually low for a CWE-94 code-injection/RCE flaw, suggesting the NVD impact scoring may understate a successful exploit while the attack-vector metrics may overstate default reachability. EPSS is low at 0.21% (10th percentile), indicating no broad, automated exploitation is expected. There is no CISA KEV listing, so there is no confirmed active exploitation. No SSVC decision data was supplied. A public gist is referenced alongside the GitHub issue, which may contain proof-of-concept detail, but POC was not formally flagged in the input, so it cannot be treated as confirmed exploit code. Net: this is a library-level code-injection bug in a niche open-source AI framework, not an internet-facing enterprise appliance - treat as a code-hygiene/supply-chain concern rather than an emergency. The AV:N/PR:N claim should be verified against how the vulnerable modify_code function actually receives input, since library functions are typically reached only through an embedding application. |
| Exploit ScenarioDerived | An application built on FinRobot v1.0.0 passes attacker-influenced text (e.g. a prompt, financial data field, or agent instruction) into CodingUtils.modify_code, which incorporates it into code that is subsequently executed, giving the attacker arbitrary code execution in the host process. A referenced public gist may document the injection, lowering the effort to reproduce. Because the input must traverse the embedding application to reach the vulnerable function, practical exploitation depends on that application exposing the code path to untrusted data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 05, 2026
Code injection in FinRobot v1.0.0 via CodingUtils.modify_code allows an attacker who can control input reaching that function to have their content executed as code by the host Python process, with the independent assessment scoring the worst case as high confidentiality, integrity and availability impact (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). FinRobot is an AI agent framework rather than a network service, so real-world exposure depends on whether the embedding application feeds untrusted prompts, agent tasks or data fields into modify_code without sanitization; there is no evidence of a default network listener, and NVD's 7.3 score (AV:N/AC:L/PR:N/UI:N/C:L/I:L/A:L) most likely reflects a worst-case integration rather than an out-of-the-box remote service. No public exploit code identified at time of analysis, no confirmed active exploitation (not in CISA KEV), and EPSS is low at 0.21% (10th percentile), so practical priority is modest despite the High base score.
RemediationAI
No vendor-released patch identified at time of analysis: the CVE references point to upstream issue https://github.com/AI4Finance-Foundation/FinRobot/issues/101 and a researcher write-up at https://gist.github.com/Ro1ME/282d3710f47d26399cbe93249aac3c09 rather than a fix commit or tagged release, so confirm current status against that issue before assuming a fixed version exists, and pin or vendor FinRobot at a known-good revision once one is published. Until then, the most effective control is to stop untrusted data from reaching the sink: do not pass raw user prompts, model completions, retrieved documents, or external API fields into CodingUtils.modify_code, and if the function must be used, wrap it with strict input validation (allowlist of permitted operations, AST parsing of the generated code before it executes, and rejection of imports, attribute access, subprocess/os/eval calls) - the trade-off is that legitimate code-modification workflows will need explicit rules and may break on novel but benign input. Isolate the execution: run FinRobot in a container or sandbox with no network egress, a read-only filesystem, dropped Linux capabilities, seccomp/AppArmor confinement, and no mounted credentials, API keys, or brokerage/financial data, accepting the performance and file-access limitations this imposes; alternatively, disable or stub out modify_code entirely in production deployments that do not require it, which removes the vulnerable feature at the cost of that functionality. Because exposure depends on the embedding application, also review the calling code for any path where external input flows into the function, and monitor for anomalous child processes or outbound connections from FinRobot hosts as a detection backstop.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-94 (Improper Control of Generation of Code / 'Code Injection'). FinRobot is an open-source financial-analysis agent framework from the AI4Finance-Foundation in which CodingUtils.modify_code manipulates and then evaluates code strings; because the modified code is subsequently executed by the Python interpreter (for example through exec/eval or an equivalent dynamic-evaluation path), any attacker-influenced string that reaches this helper becomes executable code running with the privileges of the FinRobot process. This is the classic LLM/agent-framework hazard: model output, user prompts, tool results or upstream data fields are treated as trusted code rather than as untrusted data. The vulnerability is specific to FinRobot v1.0.0; the supplied CPE string is unresolved (cpe:2.3:a:n/a:n/a:*:*:*:*:*:*:*:*), and the EUVD record EUVD-2026-91756 likewise lists affected versions as n/a, so version scoping must come from the upstream issue rather than from a vendor CPE. Note the scoring divergence: NVD rates it 7.3 with AC:L and only low per-metric impacts, whereas the independent assessment assumes AC:H and high C/I/A impact because exploitation requires the integrating application to expose the vulnerable path to externally controlled input and then execute its output; the PR:N/UI:N portion is consistent across both vectors, so no authentication or user interaction is required once such a path is reachable.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Code injection yields full code execution so C/I/A:H; AC:H because reaching modify_code requires the host application to route untrusted input into it rather than a default remote endpoint.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
FinRobot v1.0.0 is vulnerable to Code Injection in CodingUtils.modify_code.
Executive ViewAI
FinRobot v1.0.0, an open-source AI agent framework, contains a code injection weakness in its CodingUtils.modify_code function that allows content reaching that function to execute as code inside the host Python process. The practical risk to our organization depends entirely on how teams embed FinRobot: deployments that feed untrusted prompts, agent tasks, or external data fields into modify_code without sanitization could expose the full confidentiality, integrity, and availability of the surrounding application and its data. Because there is no default network listener and no vendor patch, leadership should treat this as an integration-hygiene and third-party-code governance issue rather than an immediate external attack surface, while noting that no public exploit has been identified and active exploitation is not confirmed.
No vendor-released patch identified at time of analysis. Interim mitigations: enforce strict allow-list input validation and sanitization before any data reaches CodingUtils.modify_code; avoid passing untrusted prompts, agent tasks, or external data fields into that function; execute FinRobot-based agents in a sandboxed, least-privilege container or virtual environment with restricted filesystem and network access and non-root execution; apply code review and static analysis to integration points; and monitor hosts for unexpected process spawning or anomalous outbound traffic. Apply vendor patch when it becomes available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB