CVE-2026-5594

MediumCVSS 6.3/10Last modified Jul 24, 2026

Description

A weakness has been identified in premAI-io premsql up to 0.2.1. Affected is the function eval of the file premsql/agents/baseline/workers/followup.py. This manipulation of the argument result causes code injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-74CWE-94

Affected software

No affected versions have been published.

Timeline

Published
Apr 5, 2026
Last modified
Jul 24, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-559449.8Deserialization of untrusted data in Microsoft Dynamics NAV allows an unauthorized attacker to execute code over a network.CVE-2026-559454.2Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Edge (Chromium-based) allows an autCVE-2026-559465.9Ai command injection in Microsoft Copilot allows an unauthorized attacker to disclose information over a network.CVE-2026-559477.8Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.CVE-2026-559487.8Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.CVE-2026-559497.8Use of uninitialized resource in Microsoft Office Excel allows an unauthorized attacker to execute code locally.CVE-2026-55956.3A security vulnerability has been detected in griptape-ai griptape 0.19.4. Affected by this vulnerability is the function load_files_from_diCVE-2026-559505.9Time-of-check Time-of-use (TOCTOU) race condition vulnerability in Erlang/OTP ssl (dtls_packet_demux module) allows an unauthenticated remotCVE-2026-559518.2The Erlang/OTP httpc HTTP client does not enforce a limit on the total size of response headers received from a server. The max_header_size CVE-2026-559527.5The Erlang/OTP ssl application does not validate that the PSK identity list and binder list carried in a TLS 1.3 ClientHello pre-shared key CVE-2026-559537.4The Erlang/OTP ssl TLS 1.2 (and earlier) and DTLS client does not verify that the cipher suite selected by the server in ServerHello was amoCVE-2026-559549.1Authentication Bypass by Spoofing vulnerability in ueberauth ueberauth_apple allows account takeover via unvalidated ID token claims. The U
CVE-2026-5594: Medium severity, CVSS 6.3 | Vulnix