CVE-2026-51858 in Camel
Summary
by MITRE • 10/01/2026
In camel-ai camel 0.2.91a1, v0.2.91a2 and v0.2.91a3, TerminalToolkit.shell_exec allows prompt-driven shell command execution without an approval boundary.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/01/2026
The vulnerability identified in the Camel-AI framework versions 0.2.91a1 through 0.2.91a3 centers on a critical flaw within the TerminalToolkit component, specifically affecting the shell_exec function. This issue represents a severe instance of insecure command execution where the system fails to enforce necessary approval boundaries for prompt-driven shell commands. In modern large language model applications, tools that allow direct interaction with the operating system are powerful but inherently risky if not properly sandboxed or gated by explicit user confirmation mechanisms. The absence of such safeguards in these specific versions allows an attacker who can influence the input prompts sent to the AI agent to indirectly execute arbitrary system-level commands without any intermediate validation or consent from the human operator.
From a technical perspective, this flaw aligns with CWE-78 Improper Neutralization of Special Elements used in an OS Command, commonly known as OS Command Injection. The vulnerability arises because the shell_exec function processes inputs derived directly from the model's generated prompts and passes them to the underlying operating system interpreter without sufficient sanitization or contextual restriction. When a user interacts with the Camel-AI agent, they may provide instructions that cause the model to generate tool-use calls targeting TerminalToolkit.shell_exec. Because there is no approval boundary, these commands are executed immediately upon generation by the model, bypassing any potential human-in-the-loop verification steps that should typically precede destructive or sensitive system operations.
The operational impact of this vulnerability is significant and potentially catastrophic depending on the deployment context. An adversary who gains access to the application interface can craft malicious prompts designed to trick the language model into requesting shell execution for harmful purposes. This could lead to unauthorized data exfiltration, modification or deletion of critical files, installation of malware, or using the compromised system as a pivot point for further network attacks. Since large language models are probabilistic in nature, even subtle prompt engineering techniques can successfully bypass internal safety filters if those filters rely solely on semantic understanding rather than strict technical constraints like approval gates. The lack of an explicit confirmation step means that once the model decides to invoke the shell tool based on its interpretation of the user's intent, the action is irreversible and immediate.
This vulnerability also maps closely to MITRE ATT&CK techniques related to Command and Scripting Interpreter abuse, particularly T1059 which covers various scripting languages including shell interpreters. In the context of AI-driven applications, this represents a novel attack vector where traditional perimeter defenses are insufficient because the threat originates from within the application logic itself via trusted tool interfaces. The exploitation does not require external network access if the attacker has any level of interaction with the chat interface or API endpoint that feeds prompts into the model.
To mitigate this risk, immediate updates to versions newer than 0.2.91a3 are recommended as they likely contain patches addressing these security gaps. For environments where upgrading is not immediately feasible, it is crucial to implement strict input validation and output filtering on all data passed to shell_exec functions. Additionally, developers should enforce a mandatory approval workflow for any tool that interacts with the operating system, ensuring that no command executes without explicit user confirmation. Implementing sandboxed execution environments can further limit the blast radius of such vulnerabilities by restricting the permissions available to the executed commands. Regular security audits focusing on prompt injection resistance and tool-use safety policies are essential to maintain robust defenses against evolving AI-specific threats.