CVE-2026-90617

A vulnerability was detected in GH05TCREW PentestAgent up to cf882dabea3ed91cef016cdd115e5426315665a2. This vulnerability affects the function run_task of the file interface/main.py of the component MCP HTTP Server. Performing a manipulation results in os command injection. The attack is possible to be carried out remotely. The exploit is now public and may be used. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The pull request to fix this issue awaits acceptance.

• CWE-77
• CWE-78

• https://github.com/GH05TCREW/pentestagent/
• https://github.com/GH05TCREW/pentestagent/issues/90
• https://github.com/GH05TCREW/pentestagent/pull/101
• https://vuldb.com/cve/CVE-2026-90617
• https://vuldb.com/submit/914808
• https://vuldb.com/vuln/403198
• https://vuldb.com/vuln/403198/cti

Published

Sep 14, 2026

Last Modified

Sep 15, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-90611A vulnerability was determined in GPAC up to f1219cde. This …3.3
• CVE-2026-90612A vulnerability was identified in GPAC up to f1219cde. Affec…3.3
• CVE-2026-90613A security flaw has been discovered in GPAC up to f1219cde. …3.3
• CVE-2026-90614A weakness has been identified in FedML-AI FedML up to 0.9.6…6.3
• CVE-2026-90615A security vulnerability has been detected in SourceCodester…4.3
• CVE-2026-90616In Flatpak before 1.18.1, a malicious sandboxed app can obta…7.4
• CVE-2026-90618A flaw has been found in GH05TCREW PentestAgent up to cf882d…7.3
• CVE-2026-90619A vulnerability has been found in 0x4m4 HexStrike AI up to d…7.3
• CVE-2026-9062The Store Locator WordPress plugin before 1.6.9 does not val…3.4
• CVE-2026-90620A vulnerability was determined in 0x4m4 HexStrike AI up to d…7.3
• CVE-2026-90621A vulnerability was identified in ipa-lab HackingBuddyGPT up…6.3
• CVE-2026-90622A security flaw has been discovered in GNU libredwg 0.13.4. …3.3