PT-2025-32308 · Unknown · Agentuniverse

Bayuncao · Publicado 2025-08-07 · Atualizado 2025-08-10 · CVE-2025-8697

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions agentUniverse versions up to 0.0.18

Description A critical issue exists in agentUniverse that allows for remote OS command injection. The issue affects the StdioServerParameters function within the MCPSessionManager/MCPTool/MCPToolkit component. The exploit has been publicly disclosed. The vendor was notified but did not respond.

Recommendations Versions prior to 0.0.18 are affected. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Command Injection

OS Command Injection

Enumeração de Fraquezas

CWE-77

CWE-78

Identificadores relacionados

CVE-2025-8697

Produtos afetados

Agentuniverse

Referências · 10

• 🔥 https://github.com/bayuncao-bit/vul-37#proof-of-concept · Exploit
• https://t.me/CVEtracker/29459 · Publicação no Telegram
• https://github.com/bayuncao-bit/vul-37 · Nota
• https://vuldb.com/?submit.621376 · Nota
• https://twitter.com/CVEnew/status/1953541539835031668 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2025-8697 · Nota de Segurança
• https://twitter.com/SecAideInfo/status/1954486700714893355 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/1953572665672815015 · Publicação no Twitter
• https://vuldb.com/?id.319127 · Nota
• https://vuldb.com/?ctiid.319127 · Nota