Cognition
Monthly
Unauthenticated remote code execution in Cognition before 0.13.0 lets any network-reachable attacker create a session through POST /sessions and post a message through POST /sessions/{id}/messages, driving the Deep Agents ReAct loop to execute attacker-supplied shell commands via the default local execution backend. Default deployments are exposed because the REST/SSE API ships without authentication and the agent sandbox backend defaults to local execution; publicly available exploit code exists, and the main limiting factor is whether operators placed the API behind an authenticating reverse proxy or configured a non-local sandbox backend. Vendor-released patch: 0.13.0.
Unauthenticated remote code execution in Cognition before 0.13.0 lets any network-reachable attacker create a session through POST /sessions and post a message through POST /sessions/{id}/messages, driving the Deep Agents ReAct loop to execute attacker-supplied shell commands via the default local execution backend. Default deployments are exposed because the REST/SSE API ships without authentication and the agent sandbox backend defaults to local execution; publicly available exploit code exists, and the main limiting factor is whether operators placed the API behind an authenticating reverse proxy or configured a non-local sandbox backend. Vendor-released patch: 0.13.0.