High severity · published Sep 14, 2026
CVE-2026-90618
GH05TCREW PentestAgent LocalRuntime runtime.py LocalRuntime.execute_command os command injection
7.3
CVSS
2.1%
EPSS
No
On KEV
Description
A flaw has been found in GH05TCREW PentestAgent up to cf882dabea3ed91cef016cdd115e5426315665a2. This issue affects the function LocalRuntime.execute_command of the file runtime/runtime.py of the component LocalRuntime. Executing a manipulation can lead to os command injection. The attack may be performed from remote. The exploit has been published and may be used. The pull request to fix this issue awaits acceptance.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.1% · higher than 82% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PE
PentestAgent · GH05TCREW
cf882dabea3ed91cef016cdd115e5426315665a2 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-90618
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-90618
github.com
https://github.com/GH05TCREW/pentestagent/
github.com
https://github.com/GH05TCREW/pentestagent/issues/91
github.com
https://github.com/GH05TCREW/pentestagent/pull/100
vuldb.com
https://vuldb.com/cve/CVE-2026-90618
vuldb.com
https://vuldb.com/submit/914809
vuldb.com
https://vuldb.com/vuln/403199
More from PentestAgent
7.3
CVE-2026-90617
GH05TCREW PentestAgent MCP HTTP Server main.py run_task os command injection