PT-2026-59164 · Pypi · Gpt-Pilot

Published 2026-07-13 · Updated 2026-07-13

OSV

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

GPT-Pilot thru commit 0819827ce20346ef5f25b3fe29293cb448840565 (2025-09-03) contains a command injection vulnerability (CWE-78) in the Executor.run() method. During project execution, when the system prompts the user to confirm or modify a command to be run, it accepts free-text input without proper validation. The user-supplied input is directly passed to asyncio.create subprocess shell() for execution. This allows an attacker to replace the intended command with arbitrary shell commands, leading to remote code execution with the privileges of the GPT-Pilot process.

Fix

Related Identifiers

PYSEC-2026-2501

Affected Products

Gpt-Pilot

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-31246 · Security Note
• https://osv.dev/vulnerability/PYSEC-2026-2501 · Vendor Advisory
• https://github.com/Pythagora-io/gpt-pilot · Note
• https://github.com/advisories/GHSA-m85w-whwh-qvfx · Note
• https://notion.so/CVE-2026-31246-35d1e1393188812ea3c6c88ad28d3d57 · Note
• https://pypi.org/project/gpt-pilot · Note