CVE-2026-30306

Katalog CVE

CVSS 9.8 · Critical EPSS 0,98%

Kerentanan Improper Control of Generation of Code ('Code Injection') pada rahmanazhar sakadev. Skor CVSS 3.1 9.8 (Critical) menurut CISA ADP.

Deskripsi (NVD)

In its design for automatic terminal command execution, SakaDev offers two options: Execute safe commands and execute all commands. The description for the former states that commands determined by the model to be safe will be automatically executed, whereas if the model judges a command to be potentially destructive, it still requires user approval. However, this design is highly susceptible to prompt injection attacks. An attacker can employ a generic template to wrap any malicious command and mislead the model into misclassifying it as a 'safe' command, thereby bypassing the user approval requirement and resulting in arbitrary command execution.

Rincian

Terbit di NVD

30 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-94: Improper Control of Generation of Code ('Code Injection')

EPSS (30 hari)

0,98% peluang dieksploitasi; lebih tinggi dari 61,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/Secsys-FDU/LLM-Tool-Calling-CVEs/issues/4 mitigasi · advisory pihak ketiga
• https://marketplace.visualstudio.com/items?itemName=rahmanazhar.saka-dev product