CVE-2026-67547

taOS is a self-hosted AI agent OS. Prior to version 1.0.0-beta.23, the POST /api/skill-exec/skillid/call endpoint in taOS executes built-in skills — including the codeexec skill which runs arbitrary Python via subprocess.run"python3", "-c", code — without performing any admin role check, skill...