PT-2026-26665 · Unknown · Bagofwords1

Goku · Publicado 2026-03-20 · Atualizado 2026-03-21 · CVE-2026-4500

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions bagofwords1 versions prior to 0.0.298

Description A flaw exists in the generate df function within the backend/app/ai/code execution/code execution.py file. This allows for injection attacks that can be launched remotely. The exploit is publicly available.

Recommendations Upgrade to version 0.0.298 or later.

Exploit

Correção

Improper Neutralization

Special Elements Injection

Enumeração de Fraquezas

CWE-707

CWE-74

Identificadores relacionados

CVE-2026-4500

Produtos afetados

Bagofwords1

Referências · 12

• 🔥 https://github.com/Ka7arotto/cve/blob/main/bagofwords-rce.md · Exploit
• https://github.com/bagofwords1/bagofwords/pull/63 · Correção
• https://github.com/bagofwords1/bagofwords/commit/47b20bcda31264635faff7f6b1c8095abe1861c6 · Correção
• https://github.com/bagofwords1/bagofwords/releases/tag/v0.0.298 · Correção
• https://github.com/bagofwords1/bagofwords/issues/60 · Nota
• https://osv.dev/vulnerability/CVE-2026-4500 · Aviso do Fabricante
• https://vuldb.com/?submit.773890 · Nota
• https://vuldb.com/?ctiid.352065 · Nota
• https://vuldb.com/?id.352065 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-4500 · Nota de Segurança
• https://github.com/bagofwords1/bagofwords · Nota
• https://twitter.com/CVEnew/status/2035262168820502890 · Publicação no Twitter