PT-2025-32201 · Unknown · Skyworkai Deepresearchagent

Bayuncao · Published 2025-08-06 · Updated 2025-08-06 · CVE-2025-8667

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions SkyworkAI DeepResearchAgent up to 08eb7f8eb9505d0094d75bb97ff7dacc3fa3bbf2

Description A critical vulnerability exists in SkyworkAI DeepResearchAgent. The issue is an OS command injection within the from code, from dict, and from mcp functions of the src/tools/tools.py file. This allows for remote attacks. The exploit has been publicly disclosed. Continuous delivery with rolling releases is used, and no specific version details for affected or updated releases are available.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

OS Command Injection

Command Injection

Weakness Enumeration

CWE-78

CWE-77

Related Identifiers

CVE-2025-8667

Affected Products

Skyworkai Deepresearchagent

References · 9

• 🔥❌ https://github.com/bayuncao-bit/vul-36#proof-of-concept · Exploit, Deleted
• https://nvd.nist.gov/vuln/detail/CVE-2025-8667 · Security Note
• ❌ https://github.com/bayuncao-bit/vul-36 · Note, Deleted
• https://vuldb.com/?ctiid.319026 · Note
• https://twitter.com/VulmonFeeds/status/1953219286060630249 · Twitter Post
• https://t.me/CVEtracker/29376 · Telegram Post
• https://twitter.com/CVEnew/status/1953168078256357746 · Twitter Post
• https://vuldb.com/?submit.621324 · Note
• https://vuldb.com/?id.319026 · Note