CVE-2026-123675

HighCVSS 8.3/10Last modified Nov 6, 2026

Description

A flaw has been found in OpenBMB Internet of Agents up to 9d78e88e47160eb42ee1ee8538c05e1c2c47877a. This affects the function execute_code of the file im_client/agents/tools/code_executor.py of the component Code Executor Tool. This manipulation of the argument filename/lang causes code injection. The attack can be initiated remotely. The exploit has been published and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.

Metrics

CVSS 3.1 8.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

Weakness enumeration

CWE-74CWE-94

Affected software

VendorProductVersions
OpenBMBInternet of Agents9d78e88e47160eb42ee1ee8538c05e1c2c47877a

References

Timeline

Published
Nov 6, 2026
Last modified
Nov 6, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-1236765.3A vulnerability has been found in xxyopen/201206030 novel up to 3.5.0. This impacts the function BookServiceImpl.getBookContentAbout of the CVE-2026-1236774.3A vulnerability was found in xxyopen/201206030 novel up to 3.5.0. Affected is the function getBookChapter of the file src/main/java/io/githuCVE-2026-1236959.8The Security For WooCommerce WordPress plugin through 1.0.16 does not restrict access to several of its REST API routes, allowing unauthentiCVE-2026-1236967.5The Security For WooCommerce WordPress plugin through 1.0.16 does not check that the requester is authorised before resetting two-factor autCVE-2026-1236977.5The Security For WooCommerce WordPress plugin through 1.0.16 does not restrict who can request a user's current two-factor code or two-factoCVE-2026-1236985.3The Security For WooCommerce WordPress plugin through 1.0.16 does not restrict access to one of its REST API routes, allowing unauthenticateCVE-2026-1236994.8The Security For WooCommerce WordPress plugin through 1.0.16 does not check that the requester is authorised before running bulk Security FoCVE-2026-12372.1Vulnerable cross-model authorization in juju. If a charm's cross-model permissions are revoked or expire, a malicious user who is able to upCVE-2026-123707.6ZohoCorp ManageEngine OpManager, NetFlow Analyzer, and Network Configuration Manager versions 12.8.667 and below were vulnerable to a ServerCVE-2026-1237007.5The Security For WooCommerce WordPress plugin through 1.0.16 does not check that the requester is authorised before running several of its cCVE-2026-1237015.3The Security For WooCommerce WordPress plugin through 1.0.16 does not have proper authorization checks when resetting its settings, allowingCVE-2026-1237026.5The Security For WooCommerce WordPress plugin through 1.0.16 does not check that the requester is authorised before regenerating the secret
CVE-2026-123675: High severity, CVSS 8.3 | Vulnix