PT-2026-59164 · Pypi · Gpt-Pilot

Publicado 2026-07-13 · Atualizado 2026-07-13

OSV

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

GPT-Pilot thru commit 0819827ce20346ef5f25b3fe29293cb448840565 (2025-09-03) contains a command injection vulnerability (CWE-78) in the Executor.run() method. During project execution, when the system prompts the user to confirm or modify a command to be run, it accepts free-text input without proper validation. The user-supplied input is directly passed to asyncio.create subprocess shell() for execution. This allows an attacker to replace the intended command with arbitrary shell commands, leading to remote code execution with the privileges of the GPT-Pilot process.

Correção

Identificadores relacionados

PYSEC-2026-2501

Produtos afetados

Gpt-Pilot

Referências · 6

• https://github.com/Pythagora-io/gpt-pilot · Nota
• https://github.com/advisories/GHSA-m85w-whwh-qvfx · Nota
• https://notion.so/CVE-2026-31246-35d1e1393188812ea3c6c88ad28d3d57 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-31246 · Nota de Segurança
• https://osv.dev/vulnerability/PYSEC-2026-2501 · Aviso do Fabricante
• https://pypi.org/project/gpt-pilot · Nota