Live › vulnerability › CVE-2026-120275
MiniMax Code 0.5.8 has a flaw in its Find Command Handler where the -exec argument is not sanitized, allowing operating system command injection. A remote attacker can run commands on the affected machine.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-01 23:22 UTC. All times on this page are UTC.
Anyone running MiniMax Code (Shanghai Xi Yu Ji Zhi Technology) version 0.5.8, a coding agent CLI. The CVE says the -exec argument of the find command handler is not neutralized, so OS commands can be injected; the CVE says it can be attacked remotely, but no source says how input reaches the handler (likely agent or prompt-driven command approval). The vendor did not respond to disclosure and no fix is known. Teams not using 0.5.8 can likely skip it, though other versions are untested by any source.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| MiniMax Code | npm | 0.5.8 | – |
npm ls -g minimax-code) and look for 0.5.8, the only version the CVE names0.5.9, 0.5.10, or later are affected is unknown; no source says0.6.2Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A security flaw has been discovered in Shanghai Xi Yu Ji Zhi Technology Minimax Code 0.5.8. This affects an unknown part of the component Find Command Handler. The manipulation of the argument -exec results in os command injection. The attack may be performed from remote. The vendor was contacted early about this disclosure but did not respond in any way.
This page as .md · .json · in your agent: get_signal("CVE-2026-120275")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.