PT-2026-39416 · Aandrew Me · Tgpt

Hai271120 · Published 2026-05-09 · Updated 2026-05-10 · CVE-2026-8210

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions andrew-me tgpt versions prior to 2.11.2

Description Command injection is possible in the Update Handler component via the Update() function within the helper.go file. This issue requires local access to be exploited.

Recommendations Update to a version later than 2.11.1. As a temporary workaround, restrict access to the Update() function in the Update Handler component.

Exploit

Fix

Special Elements Injection

Command Injection

Weakness Enumeration

CWE-74

CWE-77

Related Identifiers

CVE-2026-8210

Affected Products

Tgpt

References · 10

• 🔥 https://drive.google.com/file/d/19wRsehbhotZXgE1TjenFtS3w-zRtp-PW/view?usp=sharing · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-8210 · Security Note
• https://t.me/CVEtracker/53250 · Telegram Post
• https://vuldb.com/vuln/362418 · Note
• https://vuldb.com/vuln/362418/cti · Note
• https://t.me/cveNotify/162888 · Telegram Post
• https://vuldb.com/submit/803594 · Note
• https://twitter.com/infoflowcloud/status/2053539755430662403 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2053285547641057703 · Twitter Post
• https://twitter.com/CVEnew/status/2053537512258482367 · Twitter Post