CVE-2026-90617

HIGH 7.3

GH05TCREW PentestAgent MCP HTTP Server main.py run_task os command injection

CVSS Score

7.3

EPSS Score

0.0%

EPSS Percentile

0th

A vulnerability was detected in GH05TCREW PentestAgent up to cf882dabea3ed91cef016cdd115e5426315665a2. This vulnerability affects the function run_task of the file interface/main.py of the component MCP HTTP Server. Performing a manipulation results in os command injection. The attack is possible to be carried out remotely. The exploit is now public and may be used. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The pull request to fix this issue awaits acceptance.

CWE	CWE-78 CWE-77
Vendor	gh05tcrew
Product	pentestagent
Published	Sep 14, 2026
Last Updated	Sep 15, 2026

Stay Ahead of the Next One

Get instant alerts for gh05tcrew pentestagent

Be the first to know when new high vulnerabilities affecting gh05tcrew pentestagent are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

GH05TCREW / PentestAgent

cf882dabea3ed91cef016cdd115e5426315665a2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/403198 vuldb.com: https://vuldb.com/vuln/403198/cti vuldb.com: https://vuldb.com/cve/CVE-2026-90617 vuldb.com: https://vuldb.com/submit/914808 github.com: https://github.com/GH05TCREW/pentestagent/issues/90 github.com: https://github.com/GH05TCREW/pentestagent/pull/101 github.com: https://github.com/GH05TCREW/pentestagent/

Credits

🔍 ez-lbz (VulDB User) VulDB CNA Team