{"id":"CVE-2026-91140","revision":"951973ece3ca4364a17bdbe4cb837ab0","records":[{"revision":"951973ece3ca4364a17bdbe4cb837ab0","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-91140","aliases":[],"title":"OS command injection in Progress Software Autonomous REST Connector GenAI Agents","description":"An OS command injection vulnerability in the shell-based temporary-file cleanup instructions in Progress Software Autonomous REST Connector GenAI Agents ARCGenAI-Generator version 2.0 allows an attacker who supplies a crafted Swagger/OpenAPI document to execute arbitrary commands on a developer's machine when a user invokes the generator.","state":0,"publishedAt":"2026-10-06T13:46:11.357+00:00","modifiedAt":"2026-10-07T03:55:20.033+00:00","affected":[{"ecosystem":"Vendor product","name":"Autonomous REST Connector GenAI Agents","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Progress Software\",\n                    \"product\": \"Autonomous REST Connector GenAI Agents\",\n                    \"versions\": [\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"2.0\",\n                            \"lessThan\": \"2.1\",\n                            \"versionType\": \"custom\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unaffected\"\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","score":9.6,"severity":"CRITICAL"}],"references":["https://github.com/progress/datadirect-arc-ai-model-gen/commit/7ede6d96eb033d647ffdcabf8d8069c098293575","https://community.progress.com/s/article/Progress-DataDirect-Critical-Security-Alert-Bulletin-September-2026-CVE-2026-91140"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-91140","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-91140","identifiers":["CVE-2026-91140"]},"retained":false,"historicalAffected":[]}],"coverage":[]}