PT-2026-29248 · Sixth · Sixth

Secsys-Fdu · Published 2026-03-31 · Updated 2026-03-31 · CVE-2026-30310

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Sixth (affected versions not specified)

Description The software features automatic terminal command execution with two modes: 'Execute safe commands' and 'Execute all commands'. The 'Execute safe commands' mode is designed to automatically run commands deemed safe by the model, requiring user approval for potentially destructive commands. However, this design is prone to prompt injection attacks. An attacker can use a template to disguise malicious commands as 'safe' commands, bypassing the approval requirement and enabling arbitrary command execution.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2026-30310

Affected Products

Sixth

References · 4

• 🔥 https://github.com/Secsys-FDU/LLM-Tool-Calling-CVEs/issues/12 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-30310 · Security Note
• https://trysixth.com · Note
• https://twitter.com/CVEnew/status/2039004502624260261 · Twitter Post