IBM Bob is vulnerable to Remote Code Execution due to improper control of workspace-defined MCP server execution
Affects IBM Bob Shell versions 1.0.4 through 2.0.1 when a user opens an untrusted repository. The fix is in 2.0.2. The checked facts give no vendor severity rating, so only the CVSS score of 8.8 (high) applies.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
- Exploited
- No known exploitation
- Fix
- Fixed in 2.0.2
- Who is exposed
- Specific setups only
Do first: Check whether your setup matches what the bug needs. Affected product is IBM Bob Shell, versions 1.0.4 to 2.0.1 User opens an untrusted repository in Bob Shell
- Published
- Last modified
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 21/100 · provisional
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
IBM Bob, an AI-powered development tool, is affected by a flaw in how it handles workspace-defined MCP server execution that lets a remote attacker inject and run arbitrary code on the system. The attack can be carried out over the network without logging in, but it requires a user to take some action, such as opening a crafted workspace.
Read the original description
IBM Bob 1.0.4 through 2.0.1 could allow a remote attacker to inject arbitrary code on the system, due to the improper control of user input code.
cve.now Index
- Exploitation?/40Unknown. No CISA SSVC exploitation rating yet
- Exposure12/25Specific setups only, reachable over the network without a login
- Reach?/20Unknown. No tracked technology or package matched
- Severity8.8/10CVSS 8.8
- No patch0/5No signal
What would change the score
- Would score about 71 if added to CISA KEV
- Would score about 66 if CISA's SSVC rates exploitation active
What to do
Check whether your setup matches what the bug needs.
Affected product is IBM Bob Shell, versions 1.0.4 to 2.0.1 User opens an untrusted repository in Bob ShellUpgrade to a fixed version: 2.0.2.
A source says this fix is incomplete.Workaround: Only use IBM Bob Shell with trusted repositories and trusted code sources; avoid opening repositories from untrusted parties
Timeline
- CVE published
- Record last updated
- First seen by cve.now
Affected versions
- IBM Bob Shell
From 1.0.4 · through 2.0.1
Evidence 1
- Patch
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-9764
Is CVE-2026-9764 being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data
What does this mean?
A remote attacker can run arbitrary code on the system. MCP servers defined in a repository are run automatically, without the user's explicit consent, when an untrusted repository is opened in Bob Shell.Source: ibm.com
Which versions are affected by CVE-2026-9764?
Bob Shell: from 1.0.4 through 2.0.1.Source: cve.now feed data
Am I affected, and how do I check?
IBM Bob Shell versions 1.0.4 through 2.0.1 are affected, and the issue arises when a user opens an untrusted repository in Bob Shell. Check the installed Bob Shell version against that range to see which versions are in scope.Source: ibm.com
How do I fix CVE-2026-9764?
IBM strongly recommends upgrading to Bob Shell 2.0.2 or a later version. Until the upgrade is applied, use Bob Shell only with trusted repositories and trusted code sources, and avoid opening repositories from untrusted parties.Source: ibm.com
Is the fix complete?
The checked facts mark the fix as partial but do not say which part remains unfixed. The advisory recommends upgrading to 2.0.2 or later, and the full advisory should be checked for any remaining gaps.Source: ibm.com