CVE-2026-63378 | fctr-id okta-ai-agent up to 3.0.0 Script Execution react_stream.py asyncio.create_subprocess_exec script_code code injection

October 31, 2026 Yanac

A vulnerability was found in fctr-id okta-ai-agent up to 3.0.0. It has been rated as very critical. Affected by this vulnerability is the function asyncio.create_subprocess_exec of the file src/api/routers/react_stream.py of the component Script Execution. Performing a manipulation of the argument script_code results in code injection.

This vulnerability is cataloged as CVE-2026-63378. It is possible to initiate the attack remotely. There is no exploit available.

Upgrading the affected component is advised.VulDB Recent EntriesRead More