17 matches found
CVE-2026-2256-PoC
CVE-2026–2256 PoC Executive Summary A critical command injection vulnerability CVE-2026–2256, CVSS X.X was identified in the Shell tool component of the MS-Agent framework version 1.5.2. The vulnerability arises from improper sanitization of user-influenced input that is passed directly to a shel...
ModelScope MS-Agent 1.5.1 < 1.6.0 Command Injection (CVE-2026-2256)
The version of ModelScope MS-Agent installed on the remote host is 1.5.1 or later but prior to 1.6.0. It is, therefore, affected by a command injection vulnerability. The Shell tool runs commands on the host through a shell, guarded only by a regex denylist that can be bypassed, allowing an...
CVE-2026-2256-Threat-Model----ms-agent-Command-Injection
CVE-2026-2256-Threat-Model----ms-agent-Command-Injection...
PT-2026-59316
A Command Injection vulnerability in ModelScope's MS-Agent versions v1.6.0rc1 and earlier exists, allowing an attacker to execute arbitrary operating system commands through crafted prompt-derived input...
Exploit for CVE-2026-2256
CVE-2026-...
MS-Agent vulnerable to Command Injection
A Command Injection vulnerability in ModelScope's MS-Agent versions v1.6.0rc1 and earlier exists, allowing an attacker to execute arbitrary operating system commands through crafted prompt-derived input...
GHSA-4GC2-344Q-R2RW MS-Agent vulnerable to Command Injection
A Command Injection vulnerability in ModelScope's MS-Agent versions v1.6.0rc1 and earlier exists, allowing an attacker to execute arbitrary operating system commands through crafted prompt-derived input...
CVE-2026-2256
A command injection vulnerability in ModelScope's ms-agent versions v1.6.0rc1 and earlier exists, allowing an attacker to execute arbitrary operating system commands through crafted prompt-derived input...
CVE-2026-2256
A command injection vulnerability in ModelScope's ms-agent versions v1.6.0rc1 and earlier exists, allowing an attacker to execute arbitrary operating system commands through crafted prompt-derived input...
CVE-2026-2256 Command injection vulnerability in ModelScope's ms-agent
A command injection vulnerability in ModelScope's ms-agent versions v1.6.0rc1 and earlier exists, allowing an attacker to execute arbitrary operating system commands through crafted prompt-derived input...
CVE-2026-2256
ModelScope's MS-Agent (specifically version v1.5.2 and earlier, including v1.6.0rc1 ) is vulnerable to a command injection flaw in its Shell tool component. The root cause is the improper sanitization of user-influenced input, which is passed directly to a shell execution context at ms_agent/tool...
CVE-2026-2256 Command injection vulnerability in ModelScope's ms-agent
A command injection vulnerability in ModelScope's ms-agent versions v1.6.0rc1 and earlier exists, allowing an attacker to execute arbitrary operating system commands through crafted prompt-derived input...
EUVD-2026-9257
A command injection vulnerability in ModelScope's ms-agent versions v1.6.0rc1 and earlier exists, allowing an attacker to execute arbitrary operating system commands through crafted prompt-derived input...
Arbitrary Command Injection
Overview ms-agent is a MS-Agent: Lightweight Framework for Empowering Agents with Autonomous Exploration Affected versions of this package are vulnerable to Arbitrary Command Injection via the ms-agent process. An attacker can execute arbitrary operating system commands by supplying specially...
MS-Agent does not properly sanitize commands sent to its shell tool, allowing for RCE
Overview A command injection vulnerability was identified in the MS-Agent framework that can be triggered through unsanitized prompt-derived input. An attacker can craft untrusted input introduced via a chat prompt or other external content sources, resulting in arbitrary command execution on the...
CVE-2026-2256: Improper Neutralization of Special Elements used in a Command
A command injection vulnerability in ModelScope's ms-agent versions v1.6.0rc1 and earlier exists, allowing an attacker to execute arbitrary operating system commands through crafted prompt-derived input...