Exploitation ongoing with high activity in latest observed window (1 mentions)
Recommended action window: Immediate (within 24h)
NVD description
Cybersecurity AI (CAI) is an open-source framework for building and deploying AI-powered offensive and defensive automation. Versions 0.5.9 and below are vulnerable to Command Injection through the run_ssh_command_with_credentials() function, which is available to AI agents. Only password and command inputs are escaped in run_ssh_command_with_credentials to prevent shell injection; while username, host and port values are injectable. This issue does not have a fix at the time of publication.
Priority
LOW
Exploitation
ACTIVE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
2025 critical vulnerability cve-2025-67511 hit a cybersecurity ai agent. command injection exploits its autonomy. even modelscope ms-agent suffered cve-2026-2256. your ai agent needs strict input validation. assume all external data is hostile.
Post summary
The CVE‑2025‑67511 command‑injection vulnerability has been actively exploited against AI agents, highlighting the need for strict input validation.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | aliasrobotics | cybersecurity_ai | - | - | - |