CVE-2026-90621

Name of the Vulnerable Software and Affected Versions ipa-lab HackingBuddyGPT versions prior to 0.5.1

Description A remote OS command injection is possible due to improper handling of input in the ssh run command() function within the src/hackingBuddyGPT/extensions/ssh run command.py file. OS command injection is a flaw that allows an attacker to execute arbitrary operating system commands on the server.

Recommendations As a temporary workaround, consider disabling the ssh run command() function until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.