CVE-2026-90617 in PentestAgent
Summary
by MITRE • 09/14/2026
A vulnerability was detected in GH05TCREW PentestAgent up to cf882dabea3ed91cef016cdd115e5426315665a2. This vulnerability affects the function run_task of the file interface/main.py of the component MCP HTTP Server. Performing a manipulation results in os command injection. The attack is possible to be carried out remotely. The exploit is now public and may be used. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The pull request to fix this issue awaits acceptance.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/19/2026
The GH05TCREW PentestAgent software contains a critical security flaw within its MCP HTTP Server component that allows for remote operating system command injection. This vulnerability is located specifically in the run_task function found in the interface/main.py file of the application codebase. The issue stems from improper neutralization of special elements used in an operating system command, which permits an attacker to inject and execute arbitrary commands on the host system where the agent is running. Because this component operates over HTTP, the attack vector is remote, meaning a malicious actor does not need physical or local access to the target machine to exploit the flaw. The severity of this vulnerability is heightened by the fact that public exploits are already available in the wild, increasing the likelihood of active exploitation against unpatched systems.
From a technical perspective, the root cause aligns with CWE-78 Improper Neutralization of Special Elements used in an OS Command commonly known as OS Command Injection. The run_task function likely takes user-supplied input and passes it directly to system shell commands without adequate sanitization or validation. In many web-based agents, such functions are designed to execute specific tasks requested by a client over the network. If these requests include parameters that are concatenated into shell strings rather than being passed as distinct arguments to safe execution APIs, an attacker can manipulate input fields with shell metacharacters like semicolons, pipes, or ampersands. This manipulation allows the injection of additional commands that run with the privileges of the process executing the PentestAgent service. Given that pentesting tools often require elevated permissions to perform network scans and vulnerability assessments, successful exploitation could lead to complete system compromise, data exfiltration, or use of the compromised host as a pivot point for further attacks within the internal network.
The operational impact of this vulnerability is significant due to the nature of the software itself. Pentest agents are typically deployed with high privileges to facilitate comprehensive security testing. An attacker who exploits this command injection flaw gains control equivalent to that of the service account running the agent. This could allow for unauthorized access to sensitive configuration files, theft of credentials stored within the environment, or modification of test results and reports generated by the tool. Furthermore, because the product utilizes a rolling release strategy, there are no discrete version numbers to track for mitigation purposes. The vulnerability exists in all versions up to commit cf882dabea3ed91cef016cdd115e5426315665a2 and persists in any subsequent builds until the fix is merged into the main branch. This continuous delivery model complicates patch management, as administrators cannot rely on standard version-based update cycles to identify when they are running vulnerable code.
To mitigate this risk, immediate action should be taken by users of GH05TCREW PentestAgent who have not yet received a patched release from upstream developers. Since the pull request containing the fix is still awaiting acceptance, organizations must implement compensating controls until an official update is available. Network-level mitigations are highly recommended; specifically, restricting access to the MCP HTTP Server interface using firewall rules or reverse proxy configurations can limit exposure to trusted IP addresses only. Additionally, running the agent with the principle of least privilege by configuring it to operate under a restricted user account rather than root or administrator privileges can significantly reduce the impact if an exploit is attempted. Input validation should also be enforced at any intermediate layers between the client and the server, ensuring that special characters are escaped or rejected before they reach the vulnerable run_task function. Organizations should monitor upstream repositories for the acceptance of the fix and apply updates immediately upon release to close this critical security gap.