Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-90617

GH05TCREW PentestAgent MCP HTTP Server main.py run_task os command injection

CVSS 4.0 6.9 MEDIUMCVSS 3.1 7.3 HIGHCVSS 3.0 7.3 HIGHCVSS 2.0 7.5 Check source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-90617

Published

A vulnerability was detected in GH05TCREW PentestAgent up to cf882dabea3ed91cef016cdd115e5426315665a2. This vulnerability affects the function run_task of the file interface/main.py of the component MCP HTTP Server. Performing a manipulation results in os command injection. The attack is possible to be carried out remotely. The exploit is now public and may be used. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The pull request to fix this issue awaits acceptance.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-90617

Published

PentestAgent

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "GH05TCREW",
                    "product": "PentestAgent",
                    "versions": [
                        {
                            "version": "cf882dabea3ed91cef016cdd115e5426315665a2",
                            "status": "affected"
                        }
                    ],
                    "cpes": [
                        "cpe:2.3:a:gh05tcrew:pentestagent:*:*:*:*:*:*:*:*"
                    ],
                    "modules": [
                        "MCP HTTP Server"
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON