PT-2025-50557 · Unknown · Cybersecurity Ai

Published 2025-12-10 · Updated 2025-12-12 · CVE-2025-67511

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cybersecurity AI (CAI) versions 0.5.9 and below

Description Cybersecurity AI (CAI) is an open-source framework for building and deploying AI-powered offensive and defensive automation. The run ssh command with credentials() function, accessible to AI agents, is susceptible to Command Injection. While the password and command inputs are escaped to prevent shell injection, the username, host, and port values are injectable. This flaw allows attackers to manipulate backend routing logic by crafting malicious parameters, potentially gaining control over the system without authentication.

Recommendations Versions 0.5.9 and below: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2025-67511

GHSA-4C65-9GQF-4W8H

Affected Products

Cybersecurity Ai

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/67xxx/CVE-2025-67511.json · Exploit
• 🔥 https://hacktivesecurity.com/blog/2025/12/10/cve-2025-67511-tricking-a-security-ai-agent-into-pwning-itself · Exploit
• https://github.com/aliasrobotics/cai/security/advisories/GHSA-4c65-9gqf-4w8h · Vendor Advisory
• https://github.com/aliasrobotics/cai/commit/09ccb6e0baccf56c40e6cb429c698750843a999c · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-67511 · Security Note
• https://osv.dev/vulnerability/CVE-2025-67511 · Vendor Advisory
• https://twitter.com/CVEnew/status/1999108896724766960 · Twitter Post
• https://twitter.com/Awkiffffff/status/1999129904051548454 · Twitter Post
• https://twitter.com/Awkiffffff/status/1999129897676022084 · Twitter Post
• https://t.me/CVEtracker/39425 · Telegram Post
• https://twitter.com/Awkiffffff/status/1999129912754454626 · Twitter Post
• https://twitter.com/ksg93rd/status/1999324875668824235 · Twitter Post
• https://twitter.com/CveFindCom/status/1998915392123601214 · Twitter Post
• https://twitter.com/offseq/status/1998921598594855356 · Twitter Post