CVE-2026-123675 | OpenBMB Internet of Agents up to 9d78e88e47160eb42ee1ee8538c05e1c2c47877a Code Executor Tool code_executor.py execute_code filename/lang code injection (Issue 18)

November 6, 2026 Yanac

A vulnerability has been found in OpenBMB Internet of Agents up to 9d78e88e47160eb42ee1ee8538c05e1c2c47877a and classified as critical. This affects the function execute_code of the file im_client/agents/tools/code_executor.py of the component Code Executor Tool. This manipulation of the argument filename/lang causes code injection.

This vulnerability is handled as CVE-2026-123675. The attack can be initiated remotely. Additionally, an exploit exists.

Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available.

The project was informed of the problem early through an issue report but has not responded yet.VulDB Recent EntriesRead More