Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
GPT-Pilot thru commit 0819827ce20346ef5f25b3fe29293cb448840565 (2025-09-03) contains a command injection vulnerability (CWE-78) in the Executor.run() method. During project execution, when the system prompts the user to confirm or modify a command to be run, it accepts free-text input without proper validation. The user-supplied input is directly passed to asyncio.create_subprocess_shell() for execution. This allows an attacker to replace the intended command with arbitrary shell commands, leading to remote code execution with the privileges of the GPT-Pilot process.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-31246 Command Injection Vulnerability in GPT-Pilot http://Executor.run() Method https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-31246
Post summary
A command injection vulnerability (CVE-2026-31246) affecting the GPT-Pilot Executor.run() method has been disclosed, with details referenced on vulmon.com.
CVE-2026-31246 GPT-Pilot thru commit 0819827ce20346ef5f25b3fe29293cb448840565 (2025-09-03) contains a command injection vulnerability (CWE-78) in the http://Executor.run() method. During p… https://www.cve.org/CVERecord?id=CVE-2026-31246
Post summary
The text announces a command injection vulnerability (CWE‑78) in GPT‑Pilot’s Executor.run() (CVE‑2026‑31246), providing technical details but no PoC, exploit code, or mitigation information.