GHSA-m85w-whwh-qvfx
Suggest an improvement- Source
- https://github.com/advisories/GHSA-m85w-whwh-qvfx
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-m85w-whwh-qvfx/GHSA-m85w-whwh-qvfx.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-m85w-whwh-qvfx
- Aliases
-
- CVE-2026-31246
- Published
- 2026-05-11T18:31:43Z
- Modified
- 2026-05-27T23:00:28.346220022Z
- Severity
-
- 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N CVSS Calculator
- Summary
- GPT-Pilot contains a command injection vulnerability in the Executor.run() method
- Details
-
GPT-Pilot thru commit 0819827ce20346ef5f25b3fe29293cb448840565 (2025-09-03) contains a command injection vulnerability (CWE-78) in the Executor.run() method. During project execution, when the system prompts the user to confirm or modify a command to be run, it accepts free-text input without proper validation. The user-supplied input is directly passed to asyncio.createsubprocessshell() for execution. This allows an attacker to replace the intended command with arbitrary shell commands, leading to remote code execution with the privileges of the GPT-Pilot process.
- Database specific
{ "cwe_ids": [ "CWE-78" ], "github_reviewed": true, "github_reviewed_at": "2026-05-27T22:48:48Z", "nvd_published_at": "2026-05-11T16:17:29Z", "severity": "MODERATE" }- References
Affected packages
PyPI / gpt-pilot
Package
- Name
- gpt-pilot
- View open source insights on deps.dev
- Purl
- pkg:pypi/gpt-pilot