CVE-2026-30311

Ridvay Code's command auto-approval module contains a critical OS command injection vulnerability that renders its whitelist security mechanism completely ineffective. The system relies on fragile regular expressions to parse command structures; while it attempts to intercept dangerous operations, it fails to account for standard Shell command substitution Ridvay Code (specifically$(...)and backticks ...). An attacker can construct a command such as git log --grep="$(malicious_command)", forcing Syntx to misidentify it as a safe git operation and automatically approve it. The underlying Shell prioritizes the execution of the malicious code injected within the arguments, resulting in Remote Code Execution without any user interaction.

• CWE-78

• https://github.com/Secsys-FDU/LLM-Tool-Calling-CVEs/issues/8Third Party Advisory
• https://ridvay.com/Product

Published

Mar 31, 2026

Last Modified

Jul 25, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-30306In its design for automatic terminal command execution, Saka…9.8
• CVE-2026-30307Roo Code's command auto-approval module contains a critical …9.8
• CVE-2026-30308In its design for automatic terminal command execution, HAI …9.8
• CVE-2026-30309InfCode's terminal auto-execution module contains a critical…7.8
• CVE-2026-3031Image::EPEG versions through 0.15 for Perl embeds an unsuppo…9.8
• CVE-2026-30310In its design for automatic terminal command execution, Sixt…9.8
• CVE-2026-30312DSAI-Cline's command auto-approval module contains a critica…9.8
• CVE-2026-30313DSAI-Cline's command auto-approval module contains a critica…9.8
• CVE-2026-30314Ridvay Code's command auto-approval module contains a critic…9.8
• CVE-2026-30332A Time-of-Check to Time-of-Use (TOCTOU) race condition vulne…7.5
• CVE-2026-3034The OoohBoi Steroids for Elementor plugin for WordPress is v…6.4
• CVE-2026-30345A zip slip vulnerability in the Admin import functionality o…7.5