Description

A vulnerability was identified in ipa-lab HackingBuddyGPT up to 0.5.0. This affects the function ssh_run_command of the file src/hackingBuddyGPT/extensions/ssh_run_command.py. Such manipulation leads to os command injection. The attack can be launched remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-09-14T04:16:35.673Z",
  "pubdate": "2026-09-14T04:16:35.673Z",
  "executiveSummary": "A critical OS command injection vulnerability exists in ipa-lab HackingBuddyGPT versions up to 0.5.0. The vulnerability resides within the ssh_run_command function located in src/hackingBuddyGPT/extensions/ssh_run_command.py. This security flaw allows a remote, unauthenticated attacker to execute arbitrary operating system commands on the host system with the privileges of the application process. The vulnerability poses a severe security risk, as it enables full system compromise, unauthorized data exfiltration, and potential lateral movement within the network. Because the exploit is publicly available, the risk of active exploitation is significant. The project maintainers have been notified of the flaw but have not yet provided a resolution. Organizations utilizing HackingBuddyGPT in exposed environments are at high risk of remote code execution attacks.",
  "technicalDetails": "The vulnerability is classified as an OS command injection flaw, specifically occurring due to improper neutralization of special elements used in an OS command. The root cause is located in the ssh_run_command function within src/hackingBuddyGPT/extensions/ssh_run_command.py, where user-supplied input is passed directly to the underlying system shell without sufficient sanitization, validation, or the use of parameterized execution methods.\nExploitation is achieved by injecting shell metacharacters (such as ';', '&', '|', or '`') into the input fields intended for command execution. When the HackingBuddyGPT extension processes this tainted input, the shell interprets the injected characters as command separators, effectively terminating the intended command and executing the attacker's arbitrary payload. Because this function is designed to handle SSH operations, an attacker can leverage this primitive to escape the intended execution context and run malicious binaries or scripts directly on the host operating system.\nThe attack flow begins with the attacker identifying a vector where HackingBuddyGPT processes external input for SSH command orchestration. By crafting a request containing shell-injected sequences, the attacker successfully triggers the command injection. Since the vulnerability is remotely accessible, the attacker does not require local authentication to the system to initiate the exploit. The payload behavior is limited only by the permissions of the user account running the HackingBuddyGPT process; however, if the application is running with elevated privileges, the attacker can achieve full administrative control over the host.\nPost-exploitation, the attacker may establish persistence, deploy reverse shells, or scrape sensitive credentials from the host filesystem. The impact is critical, as it bypasses application-layer security controls entirely. The vulnerability affects all versions of HackingBuddyGPT up to 0.5.0. No specific authentication is required to interact with the vulnerable endpoint, and the network exposure is inherent to any deployment where the extension is reachable by an untrusted actor. Given the public availability of an exploit, attackers can easily automate the discovery and exploitation of this flaw without requiring complex manual analysis."
}