Machine-written summary
Summary written by Claude Haiku from the source advisory. Not reviewed by a person.
Cybersecurity AI (CAI) package cai-framework, versions 0.5.9 and earlier, is vulnerable to command injection in the run_ssh_command_with_credentials agent tool. The username, host and port values are not escaped before use in a shell command, while the password and command values are. An attacker who can supply fake SSH connection details that an AI agent later uses with this tool can run commands on the host where CAI is deployed. No fixed version is listed.
Not analysed yet
We haven’t published our analysis of this Advisory yet. Once a person has reviewed it, this page will say what’s vulnerable, what has to be true for your app to be affected, and how to check.
Severity and exploitation
| Score | Rating | CVSS | Vector | Source |
|---|---|---|---|---|
| 9.7 | Critical | 3.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H | CNA (GitHub_M) |
- CISA KEV Not listed.
- EPSS 0.020, the 81st percentile, on 14 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.
Timeline
Sources
- GitHub Advisory Database: GHSA-4c65-9gqf-4w8h
- OSV: GHSA-4c65-9gqf-4w8h
- github.com/aliasrobotics/cai/security/advisories/GHSA-4c65-9gqf-4w8h
- nvd.nist.gov/vuln/detail/CVE-2025-67511
- github.com/aliasrobotics/cai/commit/09ccb6e0baccf56c40e6cb429c698750843a999c
- github.com/aliasrobotics/cai
- www.hacktivesecurity.com/blog/2025/12/10/cve-2025-67511-tricking-a-security-ai-agent-into-pwning-itself
- pypi.org/project/cai-framework
- github.com/advisories/GHSA-4c65-9gqf-4w8h