Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2026-91140

OS command injection in Progress Software Autonomous REST Connector GenAI Agents

Published
Last modified
Status
published
Known exploitation
Not listed in CISA KEV
Fix
Fixed in 2.1
Public exploit
None on Exploit-DB
CISA SSVC
  • Exploitation: none
  • Automatable: no
  • Technical impact: total
?

Decision points from CISA's Vulnrichment, assessed (SSVC 2.0.3).

SSVC documentation

Summary

An OS command injection vulnerability in the shell-based temporary-file cleanup instructions in Progress Software Autonomous REST Connector GenAI Agents ARCGenAI-Generator version 2.0 allows an attacker who supplies a crafted Swagger/OpenAPI document to execute arbitrary commands on a developer's machine when a user invokes the generator.

Affected versions

  • Progress Software Autonomous REST Connector GenAI Agents

    From 2.0 · fixed in 2.1

References 2

GitHub · progress/datadirect-arc-ai-model-gen

community.progress.com