CVE-2025-67511

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-67511
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-67511.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-67511
Aliases
Published
2025-12-10T23:18:56.545Z
Modified
2026-03-14T12:46:24.175568Z
Severity
  • 9.6 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H CVSS Calculator
Summary
Cybersecurity AI (CAI) vulnerable to Command Injection in run_ssh_command_with_credentials Agent tool
Details

Cybersecurity AI (CAI) is an open-source framework for building and deploying AI-powered offensive and defensive automation. Versions 0.5.9 and below are vulnerable to Command Injection through the runsshcommandwithcredentials() function, which is available to AI agents. Only password and command inputs are escaped in runsshcommandwithcredentials to prevent shell injection; while username, host and port values are injectable. This issue does not have a fix at the time of publication.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/67xxx/CVE-2025-67511.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-77"
    ]
}
References

Affected packages

Git / github.com/aliasrobotics/cai

Affected ranges

Type
GIT
Repo
https://github.com/aliasrobotics/cai
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
09ccb6e0baccf56c40e6cb429c698750843a999c

Affected versions

0.*
0.5.6
0.5.7
0.5.8
0.5.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-67511.json"