37 matches found
CVE-2026-90619 0x4m4 HexStrike AI Execute Endpoint hexstrike_server.py os command injection
A vulnerability has been found in 0x4m4 HexStrike AI up to d689933ff579d839c676c82b231f8e98326c5f04. Impacted is an unknown function of the file hexstrikeserver.py of the component Execute Endpoint. The manipulation of the argument code/script leads to os command injection. It is possible to...
PT-2026-91033
A vulnerability has been found in 0x4m4 HexStrike AI up to d689933ff579d839c676c82b231f8e98326c5f04. Impacted is an unknown function of the file hexstrike server.py of the component Execute Endpoint. The manipulation of the argument code/script leads to os command injection. It is possible to...
PT-2026-91034
A vulnerability was determined in 0x4m4 HexStrike AI up to d689933ff579d839c676c82b231f8e98326c5f04. The impacted element is an unknown function of the file hexstrike server.py of the component API Command Endpoint. This manipulation causes missing authentication. The attack can be initiated...
CVE-2026-90620: Missing Authentication for Critical Function
A vulnerability was determined in 0x4m4 HexStrike AI up to d689933ff579d839c676c82b231f8e98326c5f04. The impacted element is an unknown function of the file hexstrikeserver.py of the component API Command Endpoint. This manipulation causes missing authentication. The attack can be initiated...
CVE-2026-90691: Improper Limitation of a Pathname to a Restricted Directory
A security vulnerability has been detected in 0x4m4 HexStrike AI up to d689933ff579d839c676c82b231f8e98326c5f04. The impacted element is the function FileOperationsManager of the file hexstrikeserver.py of the component API Files Endpoint. The manipulation of the argument filename leads to path...
CVE-2026-90619: Improper Neutralization of Special Elements used in an OS Command
A vulnerability has been found in 0x4m4 HexStrike AI up to d689933ff579d839c676c82b231f8e98326c5f04. Impacted is an unknown function of the file hexstrikeserver.py of the component Execute Endpoint. The manipulation of the argument code/script leads to os command injection. It is possible to...
PT-2026-91109
A security vulnerability has been detected in 0x4m4 HexStrike AI up to d689933ff579d839c676c82b231f8e98326c5f04. The impacted element is the function FileOperationsManager of the file hexstrike server.py of the component API Files Endpoint. The manipulation of the argument filename leads to path...
PT-2026-91108
A weakness has been identified in 0x4m4 HexStrike AI up to d689933ff579d839c676c82b231f8e98326c5f04. The affected element is the function subprocess.Popen of the file hexstrike server.py of the component API Tools Endpoint. Executing a manipulation of the argument additional...
CVE-2026-90690: Improper Neutralization of Special Elements used in an OS Command
A weakness has been identified in 0x4m4 HexStrike AI up to d689933ff579d839c676c82b231f8e98326c5f04. The affected element is the function subprocess.Popen of the file hexstrikeserver.py of the component API Tools Endpoint. Executing a manipulation of the argument...
CVE-2025-35028
By providing a command-line argument starting with a semi-colon ; to an API endpoint created by the EnhancedCommandExecutor class of the HexStrike AI MCP server, the resultant composed command is executed directly in the context of the MCP server’s normal privilege; typically, this is root. There...
CVE-2025-35028 HexStrike AI MCP Server Command Injection
By providing a command-line argument starting with a semi-colon ; to an API endpoint created by the EnhancedCommandExecutor class of the HexStrike AI MCP server, the resultant composed command is executed directly in the context of the MCP server’s normal privilege; typically, this is root. There...
CVE-2025-35028 HexStrike AI MCP Server Command Injection
By providing a command-line argument starting with a semi-colon ; to an API endpoint created by the EnhancedCommandExecutor class of the HexStrike AI MCP server, the resultant composed command is executed directly in the context of the MCP server’s normal privilege; typically, this is root. There...
CVE-2025-35028
HexStrike AI MCP Server is affected by a command-injection vulnerability in the EnhancedCommandExecutor API endpoint. A command-line argument starting with a semicolon (;) can cause a composed command to run with the MCP server’s privileges (typically root) because default configurations do not s...
CVE-2025-35028: Improper Neutralization of Special Elements used in an OS Command
By providing a command-line argument starting with a semi-colon ; to an API endpoint created by the EnhancedCommandExecutor class of the HexStrike AI MCP server, the resultant composed command is executed directly in the context of the MCP server’s normal privilege; typically, this is root. There...
HexStrike AI MCP Agents 安全漏洞
HexStrike AI MCP Agents is an MCP server by the individual developer Muhammad Osama. HexStrike AI MCP Agents suffers from a security vulnerability that stems from not cleaning up command line parameters, which could lead to the execution of arbitrary code...
PT-2025-48397
Name of the Vulnerable Software and Affected Versions HexStrike AI MCP Server versions prior to commit 2f3a5512 Description The HexStrike AI MCP Server is susceptible to a command injection issue. By supplying a command-line argument beginning with a semicolon ; to an API endpoint created by the...
