UBUNTU-CVE-2026-31236

See a problem?
Please try reporting it to the source first.

Source

https://ubuntu.com/security/CVE-2026-31236

Import Source

https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-31236.json

JSON Data

https://api.osv.dev/v1/vulns/UBUNTU-CVE-2026-31236

Upstream

CVE-2026-31236

Published

2026-05-12T18:16:00Z

Modified

2026-06-30T18:17:48Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
7.3 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H CVSS Calculator
Ubuntu - medium

Summary

[none]

Details

The llm CLI tool thru 0.27.1 contains a critical code injection vulnerability via its --functions command-line argument. This argument is intended to allow users to provide custom Python function definitions. However, the tool directly executes the provided code using the unsafe exec() function without any sanitization, sandboxing, or security restrictions. An attacker can exploit this by crafting a malicious llm command with arbitrary Python code in the --functions argument and using social engineering to trick a victim into running it. This leads to arbitrary code execution on the victim's system, potentially granting the attacker full control.

References

Affected packages

Ubuntu:25.10 / llm

Package

Name: llm
Purl: pkg:deb/ubuntu/llm?arch=source&distro=questing

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

0.*

0.23-1

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "llm",
            "binary_version": "0.23-1"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-31236.json"

Ubuntu:26.04:LTS / llm