PT-2026-28397 · Ai Code · Ai Code

CVE-2026-30304 · Publicado 2026-03-27 · Atualizado 2026-03-31

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions AI Code (affected versions not specified)

Description The software’s design, which includes options for executing safe and all commands, is susceptible to prompt injection attacks. The system is intended to automatically execute commands deemed safe by the model, while requiring user approval for potentially destructive commands. However, an attacker can use a template to disguise malicious commands as safe, bypassing the approval requirement and enabling arbitrary command execution.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2026-30304

Produtos afetados

Ai Code

Referências · 6

• 🔥 https://github.com/Secsys-FDU/LLM-Tool-Calling-CVEs/issues/2 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-30304 · Nota de Segurança
• https://twitter.com/ai_security_10x/status/2039013023130771730 · Publicação no Twitter
• https://marketplace.visualstudio.com/items?itemName=tianguaduizhang.claude-dev-china · Nota
• https://twitter.com/TheHackerWire/status/2037696168474628123 · Publicação no Twitter
• https://twitter.com/CosmicBytez/status/2038115902911361073 · Publicação no Twitter