{"data":{"id":"d43ba692-5fdb-4979-af5a-42109b0b3c58","title":"CVE-2026-31246: GPT-Pilot thru commit 0819827ce20346ef5f25b3fe29293cb448840565 (2025-09-03) contains a command injection vulnerability…","summary":"GPT-Pilot, through commit 0819827ce20346ef5f25b3fe29293cb448840565 (2025-09-03), contains a command injection flaw (CWE-78) in the Executor.run() method. When the system asks the user to confirm or modify a command during project execution, it accepts free-text input without validation and passes it directly to asyncio.create_subprocess_shell(). An attacker can replace the intended command with arbitrary shell commands, gaining code execution with the privileges of the GPT-Pilot process.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-31246","publishedAt":"2026-05-11T16:17:29.623Z","cveId":"CVE-2026-31246","cweIds":null,"cvssScore":null,"cvssSeverity":null,"severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":["gpt-pilot@<= 0.0.10"],"affectedPackageNames":["gpt-pilot"],"affectedPackageRefs":["pypi:gpt-pilot"],"affectedVendors":[],"affectedVendorsRaw":["GPT-Pilot"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"GPT-Pilot command injection in Executor.run() through user-confirmed commands","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00704,"epssCheckedAt":"2026-11-07T12:08:48.810Z","kevDateAdded":null,"advisoryAliases":["GHSA-m85w-whwh-qvfx"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:48:41.927Z","patchAvailable":null,"disclosureDate":"2026-05-11T16:17:29.623Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"agent","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[]}}