PT-2026-26665 · Unknown · Bagofwords1

Goku · CVE-2026-4500 · Published 2026-03-20 · Updated 2026-03-21

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions bagofwords1 versions prior to 0.0.298

Description A flaw exists in the generate df function within the backend/app/ai/code execution/code execution.py file. This allows for injection attacks that can be launched remotely. The exploit is publicly available.

Recommendations Upgrade to version 0.0.298 or later.

Exploit

Fix

Improper Neutralization

Special Elements Injection

Weakness Enumeration

CWE-707

CWE-74

Related Identifiers

CVE-2026-4500

Affected Products

Bagofwords1

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/4xxx/CVE-2026-4500.json · Exploit
• 🔥 https://github.com/Ka7arotto/cve/blob/main/bagofwords-rce.md · Exploit
• https://github.com/bagofwords1/bagofwords/releases/tag/v0.0.298 · Patch
• https://github.com/bagofwords1/bagofwords/pull/63 · Patch
• https://github.com/bagofwords1/bagofwords/commit/47b20bcda31264635faff7f6b1c8095abe1861c6 · Patch
• https://osv.dev/vulnerability/CVE-2026-4500 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-4500 · Security Note
• https://github.com/bagofwords1/bagofwords/issues/60 · Note
• https://vuldb.com/?id.352065 · Note
• https://vuldb.com/?ctiid.352065 · Note
• https://github.com/bagofwords1/bagofwords · Note
• https://twitter.com/CVEnew/status/2035262168820502890 · Twitter Post
• https://vuldb.com/?submit.773890 · Note