CVE-2026-5594Disclosure

LOWCVSS 2.1 · LOW

Exploit discussion active in current signal (3 latest mentions)

Immediate actions

  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft
  • Track advisory updates for patch or workaround availability

Recommended action window: High priority (within 72h)

NVD description

A weakness has been identified in premAI-io premsql up to 0.2.1. Affected is the function eval of the file premsql/agents/baseline/workers/followup.py. This manipulation of the argument result causes code injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

1.5/ 10 priority

Sources & remediation

Weakness type (CWE)
CWE-74CWE-94

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

NONE

Threat summary

  • Public PoC is present in monitored signal
  • 3 mentions across 1 observed day

What's happening

  • PoC mentioned or linked in 1 signal
  • Technical details provided in 3 signals
  • Disclosure: 2 classified signals
  • 3 total mentions across 1 day

Deep dive

Activity timeline3 mentions / 1d
01223Mentions · 2026-04-05: 3PoC Mentioned / Linked · 2026-04-05: 1Technical Details · 2026-04-05: 304-05
Signal classification2 categories
Disclosure
266.7%
PoC
133.3%
Referenced assets4 URLs
Full discourse3 posts
  • CyberDudeBivash® | Global Cybersecurity Company@cyberbivash
    PoC

    🚨 CYBERDUDEBIVASH SENTINEL APEX ALERT 🚨 Threat: CVE-2026-5594 - premAI-io premsql http://followup.py eval code injection Intel Report: https://ift.tt/4jpICfW

    Post summary

    A threat alert for CVE-2026-5594 highlights a code injection vulnerability with a link to potential PoC code, but lacks details on exploitation tools, active attacks, or remediation.

    0000033
    281 followersView on X
  • Infoflowcloud@infoflowcloud
    Disclosure

    🚨*CVE* CVE-2026-5594 A weakness has been identified in premAI-io premsql up to 0.2.1. Affected is the function eval of the file premsql/agents/baseline/workers/followup.py. This manipulatio… https://www.cve.org/CVERecord?id=CVE-2026-5594 ----- Traducción: CVE-2026-5594 Se … http://infoflow.cloud`

    Post summary

    The text provides a brief disclosure of CVE-2026-5594, highlighting a weakness in the eval function of premsql up to version 0.2.1, with no PoC or exploitation details mentioned.

    0000041
    63 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-5594 A weakness has been identified in premAI-io premsql up to 0.2.1. Affected is the function eval of the file premsql/agents/baseline/workers/followup.py. This manipulatio… https://www.cve.org/CVERecord?id=CVE-2026-5594

    Post summary

    The post announces the discovery of CVE‑2026‑5594 in premAI‑io premsql, noting the vulnerable eval function but provides no PoC, exploit, or patch information.

    00000451
    56.8K followersView on X

Explore more