| शीर्षक | OpenFang 0.6.9 Denial of Service |
|---|
| विवरण | OpenFang 0.6.9 contains a denial-of-service vulnerability in the shell_exec tool. The tool executes model-selected shell commands and captures child process stdout/stderr with full in-memory buffering before applying output truncation. An attacker who can interact with a shell-enabled agent can induce a command that continuously or massively writes output, causing the OpenFang process to consume excessive memory and terminate. In real deployments this can make the agent service, dashboard, and API endpoints unavailable, affecting all users sharing the same instance. |
|---|
| स्रोत | ⚠️ https://github.com/outlookgp/CVE/tree/main/OpenFang_ShellExec_Output_Buffer_DoS_Report |
|---|
| उपयोगकर्ता | outlookgp (UID 99658) |
|---|
| सबमिशन | 11/07/2026 03:41 PM (2 महीनों पहले) |
|---|
| संयम | 02/09/2026 04:19 PM (2 months later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 398138 [RightNow-AI OpenFang तक 0.6.9 tool_runner.rs shell_exec सेवा अस्वीकार] |
|---|
| अंक | 20 |
|---|