🚨 AI SECURITY / COMMAND INJECTION — TWO HIGH-SEVERITY CVEs HAVE BEEN PUBLISHED FOR PENTESTAGENT CVE-2026-90617 + CVE-2026-90618 CyberSignal Priority: 🟠 HIGH This is a perfect example of the new attack surface created when an LLM is connected directly to powerful tools. CVE-2026-90617 affects PentestAgent's MCP HTTP Server. The vulnerable path can lead to OS command injection through the run-task functionality. CVE-2026-90618 affects: LocalRuntime.execute_command in: runtime/runtime.py Public vulnerability information says exploitation can occur remotely and public exploit information exists. The dangerous architecture is easy to understand: UNTRUSTED TARGET DATA ↓ AI interprets it ↓ AI generates command ↓ shell executes command Specially crafted data returned by a server, SSH service or DNS record could potentially influence the model's decision-making if agent output reaches the shell without strong isolation. Public fix pull requests were still awaiting acceptance when the vulnerabilities were listed. 🛡️ Defender action If testing PentestAgent: → isolate execution → restrict outbound networking → use disposable environments → apply least privilege → require approval before shell execution → treat ALL target responses as untrusted 🧠 CyberSignal insight Prompt injection becomes far more serious when the model has a shell behind it. Then "AI manipulation" can become operating-system command execution. Sources: CVE feeds · NVD references · SecNews Published: September 14, 2026
Post summary
The post announces two high-severity OS command injection CVEs in PentestAgent, provides technical details about the vulnerabilities and their attack chain, notes that public exploit information exists, and offers mitigation guidance for defenders.