CVE-2026-90617 | GH05TCREW PentestAgent up to cf882dabea3ed91cef016cdd115e5426315665a2 MCP HTTP Server interface/main.py run_task os command injection (Issue 90)

September 12, 2026 Yanac

A vulnerability marked as critical has been reported in GH05TCREW PentestAgent up to cf882dabea3ed91cef016cdd115e5426315665a2. This vulnerability affects the function run_task of the file interface/main.py of the component MCP HTTP Server. Performing a manipulation results in os command injection.

This vulnerability is reported as CVE-2026-90617. The attack is possible to be carried out remotely. Moreover, an exploit is present.

This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified.

The pull request to fix this issue awaits acceptance.VulDB Recent EntriesRead More