CVE-2026-123675

{
  "etk_id": "ETK-2026-3751",
  "cve_id": "CVE-2026-123675",
  "display_id": "CVE-2026-123675",
  "ghsa_id": "GHSA-w43h-qvhf-jh65",
  "euvd_id": "EUVD-2026-118307",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Code injection in Internet of Agents Code Executor Tool",
  "summary": "Internet of Agents deployments through commit 9d78e88e47160eb42ee1ee8538c05e1c2c47877a may be affected by code injection in the Code Executor Tool. An unauthenticated remote attacker may execute injected code when the tool is reachable through a remotely accessible interface.",
  "mitigation": "Remove public access to the Code Executor Tool and restrict its use to trusted callers until the issue is corrected. Disable the tool where it is not required, and monitor the project for an updated revision; no fixed version is recorded.",
  "vendor": "OpenBMB",
  "product": "Internet of Agents",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "9d78e88e47160eb42ee1ee8538c05e1c2c47877a"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "Internet of Agents",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 8.3,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 30.457039666666667,
  "t0_at": "2026-11-06T15:15:17.963000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-11-06T15:15:17.963000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-06T15:15:17.963000+00:00",
      "url": "https://github.com/advisories/GHSA-w43h-qvhf-jh65"
    }
  }
}