CVE-2026-102874

HIGH 7.3

HKUDS AnyTool Execute Endpoint main.py subprocess.run os command injection

CVSS Score

7.3

EPSS Score

0.0%

EPSS Percentile

0th

A vulnerability was identified in HKUDS AnyTool 0.1.0. Affected is the function subprocess.run of the file anytool/local_server/main.py of the component Execute Endpoint. The manipulation of the argument command/shell leads to os command injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.

CWE	CWE-78 CWE-77
Vendor	hkuds
Product	anytool
Published	Sep 30, 2026

Stay Ahead of the Next One

Get instant alerts for hkuds anytool

Be the first to know when new high vulnerabilities affecting hkuds anytool are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

HKUDS / AnyTool

0.1.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/411510 vuldb.com: https://vuldb.com/vuln/411510/cti vuldb.com: https://vuldb.com/cve/CVE-2026-102874 vuldb.com: https://vuldb.com/submit/949780 github.com: https://github.com/HKUDS/AnyTool/issues/6 github.com: https://github.com/HKUDS/AnyTool/

Credits

🔍 Ccruch (VulDB User) VulDB CNA Team