Description

AgenticSeek (commit fc242c7) contains an unauthenticated remote code execution vulnerability that allows any network-adjacent attacker to execute arbitrary commands by submitting crafted queries to the unprotected POST /query API endpoint bound to 0.0.0.0:7777 with wildcard CORS. Attackers can send unauthenticated HTTP requests that cause the autonomous agent to generate and execute shell commands through BashInterpreter using subprocess.Popen with shell=True and safety=False, bypassing the incomplete command blocklist to achieve full host-level code execution.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-13T22:17:23.340Z",
  "pubdate": "2026-08-13T22:17:23.340Z",
  "executiveSummary": "AgenticSeek (commit fc242c7) contains a critical remote code execution vulnerability that exposes the system to unauthenticated network-adjacent attackers. The flaw stems from an unprotected POST /query API endpoint bound to 0.0.0.0:7777, combined with wildcard CORS configurations that permit cross-origin interactions. Attackers can submit maliciously crafted HTTP requests containing arbitrary query payloads to the autonomous agent without requiring prior authentication or valid session credentials.\nUpon ingestion, the vulnerable application processes the input and delegates execution to the BashInterpreter component. This component utilizes Python's subprocess.Popen with shell=True and safety=False enabled, routing untrusted input directly into the underlying operating system shell. Furthermore, the built-in command blocklist is incomplete and easily bypassed, allowing malicious actors to construct arbitrary shell commands.\nThe business and operational impact of this vulnerability is severe, resulting in full host-level code execution with the privileges of the running AgenticSeek service. A successful exploit grants malicious actors total control over the affected host system, enabling unauthorized data exfiltration, lateral movement within the network, deployment of persistent malware, and complete compromise of the underlying infrastructure integrity.",
  "technicalDetails": "The vulnerability resides in AgenticSeek (commit fc242c7) within the API routing and command execution subsystems. The application binds its HTTP server directly to all network interfaces at 0.0.0.0:7777 and exposes an unauthenticated POST /query endpoint. Additionally, the service implements wildcard Cross-Origin Resource Sharing (CORS) headers, permitting unauthorized cross-origin requests from arbitrary web contexts.\nThe root cause of the remote code execution vulnerability is the insecure delegation of user-supplied query data to the BashInterpreter component. When a client submits a crafted query to the POST /query endpoint, the autonomous agent processes the input and attempts to evaluate or execute it via system commands. The interpreter instantiates Python's subprocess.Popen function utilizing shell=True alongside safety=False. This execution model forces the operating system shell to parse and execute the string directly, exposing the application to shell injection attacks.\nTo achieve exploitation, an attacker on the adjacent network crafts an HTTP POST request containing a malicious query payload designed to bypass the application's native defensive measures. The payload leverages the lack of authentication on the POST /query endpoint to bypass access controls entirely. Because the application relies on an incomplete command blocklist rather than robust input sanitization, the attacker can obfuscate or structure shell commands to evade string matching filters.\nOnce the input reaches the BashInterpreter, subprocess.Popen spawns a shell process executing the injected command string with the full execution privileges of the AgenticSeek service. This leads to immediate post-exploitation impact, including arbitrary command execution, retrieval of sensitive environment variables, file system manipulation, and complete host takeover."
}