CVE-2026-72776

Name of the Vulnerable Software and Affected Versions AgenticSeek version fc242c7

Description An unauthenticated remote code execution issue exists that allows network-adjacent attackers to execute arbitrary commands. By submitting crafted queries to the unprotected 'POST /query' API endpoint, an attacker can trigger the autonomous agent to generate and execute shell commands. This occurs through the BashInterpreter using subprocess.Popen with shell=True and safety=False, which bypasses an incomplete command blocklist to achieve full host-level code execution.

Recommendations For version fc242c7, restrict access to the 'POST /query' API endpoint or disable the BashInterpreter function to prevent unauthorized command execution.