🚨 AI SECURITY / COMMAND INJECTION — TWO HIGH-SEVERITY CVEs HAVE BEEN PUBLISHED FOR PENTESTAGENT CVE-2026-90617 + CVE-2026-90618 CyberSignal Priority: 🟠 HIGH This is a perfect example of the new attack surface created when an LLM is connected directly to powerful tools. CVE-2026-90617 affects PentestAgent's MCP HTTP Server. The vulnerable path can lead to OS command injection through the run-task functionality. CVE-2026-90618 affects: LocalRuntime.execute_command in: runtime/runtime.py Public vulnerability information says exploitation can occur remotely and public exploit information exists. The dangerous architecture is easy to understand: UNTRUSTED TARGET DATA ↓ AI interprets it ↓ AI generates command ↓ shell executes command Specially crafted data returned by a server, SSH service or DNS record could potentially influence the model's decision-making if agent output reaches the shell without strong isolation. Public fix pull requests were still awaiting acceptance when the vulnerabilities were listed. 🛡️ Defender action If testing PentestAgent: → isolate execution → restrict outbound networking → use disposable environments → apply least privilege → require approval before shell execution → treat ALL target responses as untrusted 🧠 CyberSignal insight Prompt injection becomes far more serious when the model has a shell behind it. Then "AI manipulation" can become operating-system command execution. Sources: CVE feeds · NVD references · SecNews Published: September 14, 2026
Post summary
The text announces two high-severity command injection CVEs affecting PentestAgent, provides detailed technical vulnerability information and exploitation architecture, notes that public exploit information exists but no patches have been released yet, and offers defensive recommendations without naming any specific exploit tool, PoC, or confirmed active exploitation.