PT-2025-32308 · Unknown · Agentuniverse

Bayuncao · Published 2025-08-07 · Updated 2025-08-10 · CVE-2025-8697

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions agentUniverse versions up to 0.0.18

Description A critical issue exists in agentUniverse that allows for remote OS command injection. The issue affects the StdioServerParameters function within the MCPSessionManager/MCPTool/MCPToolkit component. The exploit has been publicly disclosed. The vendor was notified but did not respond.

Recommendations Versions prior to 0.0.18 are affected. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Command Injection

OS Command Injection

Weakness Enumeration

CWE-77

CWE-78

Related Identifiers

CVE-2025-8697

Affected Products

Agentuniverse

References · 10

• 🔥 https://github.com/bayuncao-bit/vul-37#proof-of-concept · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-8697 · Security Note
• https://t.me/CVEtracker/29459 · Telegram Post
• https://github.com/bayuncao-bit/vul-37 · Note
• https://vuldb.com/?submit.621376 · Note
• https://twitter.com/CVEnew/status/1953541539835031668 · Twitter Post
• https://twitter.com/SecAideInfo/status/1954486700714893355 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1953572665672815015 · Twitter Post
• https://vuldb.com/?id.319127 · Note
• https://vuldb.com/?ctiid.319127 · Note