CVE-2026-91140 in Autonomous REST Connector GenAI Agents
Summary
by MITRE • 10/06/2026
An OS command injection vulnerability in the shell-based temporary-file cleanup instructions in Progress Software Autonomous REST Connector GenAI Agents ARCGenAI-Generator version 2.0 allows an attacker who supplies a crafted Swagger/OpenAPI document to execute arbitrary commands on a developer's machine when a user invokes the generator.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/06/2026
The vulnerability identified as OS command injection within the shell-based temporary-file cleanup instructions of Progress Software Autonomous REST Connector GenAI Agents ARCGenAI-Generator version 2.0 represents a critical security flaw that compromises the integrity and confidentiality of developer workstations. This specific weakness arises from improper neutralization of special elements used in operating system commands, allowing an attacker to inject arbitrary shell commands into the execution context of the application. The root cause lies in how the software handles user-supplied input during the generation process, specifically when processing Swagger or OpenAPI documents that define API specifications. When a developer invokes the generator with such a document, the underlying script fails to adequately sanitize filenames or paths derived from the specification before passing them to system-level shell commands for temporary file management and cleanup operations.
An attacker can exploit this vulnerability by crafting a malicious Swagger or OpenAPI document containing specially designed strings within field names, path parameters, or description fields that are subsequently used as part of file naming conventions during the code generation phase. Because these generated filenames are directly interpolated into shell commands without proper escaping or validation, the operating system interprets injected command separators and arguments as executable instructions rather than literal filename characters. This allows for arbitrary command execution with the privileges of the user running the generator tool. The impact is severe, potentially leading to full compromise of the developer's machine, including data exfiltration, installation of malware, or use of the compromised system as a pivot point for further attacks within the corporate network.
From an industry standard perspective, this vulnerability aligns with CWE-78 Improper Neutralization of Special Elements used in an OS Command and is categorized under ATT&CK technique T1059 Command and Scripting Interpreter, specifically sub-technique T1059.004 Unix Shell. The attack vector involves supplying a crafted input file which falls under the broader category of CWE-20 Improper Input Validation. The operational impact extends beyond immediate code execution; it undermines trust in automated development tools and can lead to significant downtime, loss of intellectual property, and potential regulatory non-compliance if sensitive data is accessed or exfiltrated during exploitation.
Mitigation strategies must focus on both immediate remediation and long-term architectural improvements. Progress Software should release a patched version that enforces strict input validation for all fields derived from Swagger/OpenAPI documents before they are used in file system operations. Developers utilizing this tool should immediately cease using untrusted or externally sourced API specifications until the patch is applied. In environments where upgrading is not immediately feasible, implementing application whitelisting can prevent unauthorized shell commands from executing even if injection occurs. Additionally, running the generator with minimal privileges and isolating it within a sandboxed environment such as a container or virtual machine can limit the blast radius of any successful exploitation attempt. Regular security training for development teams on secure coding practices regarding external input handling is also recommended to reduce future risk exposure.