Description

A flaw has been found in OpenBMB Internet of Agents up to 9d78e88e47160eb42ee1ee8538c05e1c2c47877a. This affects the function execute_code of the file im_client/agents/tools/code_executor.py of the component Code Executor Tool. This manipulation of the argument filename/lang causes code injection. The attack can be initiated remotely. The exploit has been published and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.3",
  "pubDate": "2026-11-06T16:17:54.737Z",
  "pubdate": "2026-11-06T16:17:54.737Z",
  "executiveSummary": "A critical code injection vulnerability exists within the OpenBMB Internet of Agents project, specifically affecting the Code Executor Tool component.\nThe vulnerability originates from improper neutralization of input arguments within the execute_code function, allowing remote attackers to inject and execute arbitrary code.\nThe flaw affects OpenBMB Internet of Agents versions up to commit hash 9d78e88e47160eb42ee1ee8538c05e1c2c47877a.\nThe risk is classified as critical, as it allows remote code execution (RCE) on the host system running the agent framework.\nThe exploitation process does not appear to require complex authentication, granting an attacker the ability to compromise the integrity and availability of the system.\nAs the project utilizes a continuous delivery model without specific versioned releases and has not yet addressed the reported issue, systems currently running this software are at high risk of exploitation.",
  "technicalDetails": "The vulnerability is located in the im_client/agents/tools/code_executor.py file within the execute_code function.\nThe root cause is an insufficient sanitization mechanism for the 'filename' and 'lang' arguments passed to the code execution engine.\nThe function fails to adequately validate or escape these parameters before they are processed by the underlying interpreter or shell command execution sub-routine.\nAn attacker can exploit this by crafting malicious input for the 'filename' or 'lang' parameters. Because the application processes these strings insecurely, the attacker can break out of the intended execution context.\nFor example, by injecting shell metacharacters or path traversal sequences (e.g., ';', '&&', or '../'), an attacker can trick the system into executing arbitrary commands with the privileges of the agent process.\nThe attack flow begins with the attacker sending a specially crafted request to the agent interface. When the agent receives this input and invokes the execute_code function, the malicious payload is passed into the shell execution flow.\nSince the software is designed to execute code as part of its normal operation, the system effectively facilitates the execution of arbitrary commands provided by the external actor.\nThe impact of a successful exploit is full remote code execution. An attacker can leverage this access to install persistent backdoors, exfiltrate sensitive data stored within the agent environment, move laterally through the network, or perform unauthorized actions on behalf of the agent.\nThe vulnerability is remotely exploitable, meaning an attacker does not require local access to the server. The lack of robust input validation at the entry point of the code execution tool means that any untrusted source of 'filename' or 'lang' input constitutes a high-security risk.\nPost-exploitation, the attacker has the same level of access as the user account running the OpenBMB Internet of Agents process, potentially leading to a complete compromise of the underlying host operating system."
}