PyPIPackage

cai-framework

2 known vulnerabilities (2 critical), with the versions each affects and the releases that fix them.

Latest release: 0.5.10 (Dec 19, 2025): affected by CVE-2026-25130
Newest unaffected release: Every release is affected by at least one advisory
Advisories: 2 · 2 critical

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

CVE-2026-25130Critical 9.7
Cybersecurity AI vulnerable to command Injection through argument injection in find_file Agent tool
Affected: through 0.5.10.
No fix released. The latest release, 0.5.10, is still affected.
CVE-2025-67511Critical 9.7
Cybersecurity AI (CAI) vulnerable to Command Injection in run_ssh_command_with_credentials Agent tool
Affected: through 0.5.9.
Fixed in 0.5.10 (released Dec 19, 2025, 9 days after disclosure), the first release outside every affected range (no listed fixed version clears them all).
The latest release, 0.5.10, is not affected.