VU#431821: MS-Agent does not properly sanitize commands sent to its shell tool, allowing for RCE
2026-03-04T20:25:27Z•3d0b31f16d3e6f4bb92648d901a20ff8fead8ded094b39949d4c2a0ea763902f
CVE-2025-65586CVE-2026-2256SSTIarbitrary-file-writeccode-injectioncommand-injectiondenial-of-servicehardcoded-secretsimage-decoderjwt-forgerykernel-driver-ioctlnodejsout-of-bounds-readpath-traversalpdf-parsingprivilege-escalationprototype-pollutionpythonremote-code-executionserver-side-template-injectionstack-buffer-overflow
What happened
This collection documents multiple distinct vulnerabilities across open-source and commercial software: a command-injection RCE in ModelScope’s MS‑Agent Shell tool (CVE-2026-2256); a PyMuPDF 1.26.5 path-traversal allowing arbitrary file write via embedded file metadata; CASL Ability prototype-pollution (rulesToFields/setByPath) enabling global object prototype compromise; an out-of-bounds read in libheif’s uncompressed codec causing crash/DoS (CVE-2025-65586); binary-parser code-injection for untrusted parser definitions (fixed in 2.3.0); Open5GS WebUI using hard-coded/default JWT secrets that
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- certcc_vulnotes
- Record identifier
- 3d0b31f16d3e6f4bb92648d901a20ff8fead8ded094b39949d4c2a0ea763902f
- Enrichment time
- 2026-03-04T20:25:27Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.