PT-2026-29248 · Sixth · Sixth

Secsys-Fdu · Publicado 2026-03-31 · Atualizado 2026-03-31 · CVE-2026-30310

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Sixth (affected versions not specified)

Description The software features automatic terminal command execution with two modes: 'Execute safe commands' and 'Execute all commands'. The 'Execute safe commands' mode is designed to automatically run commands deemed safe by the model, requiring user approval for potentially destructive commands. However, this design is prone to prompt injection attacks. An attacker can use a template to disguise malicious commands as 'safe' commands, bypassing the approval requirement and enabling arbitrary command execution.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Command Injection

Enumeração de Fraquezas

CWE-77

Identificadores relacionados

CVE-2026-30310

Produtos afetados

Sixth

Referências · 4

• 🔥 https://github.com/Secsys-FDU/LLM-Tool-Calling-CVEs/issues/12 · Exploit
• https://trysixth.com · Nota
• https://twitter.com/CVEnew/status/2039004502624260261 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-30310 · Nota de Segurança