OPENBMB/IOA · CVE-2026-123675 · AI agents & MCP
NO FIX YET
In OpenBMB IoA (Internet of Agents), execute_code in im_client/agents/tools/code_executor.py is documented as running in Docker but runs a local subprocess. The filename argument is joined to the work dir without sanitization, so ../ writes files outside it. The lang argument maps to local bash/sh/powershell. Per the reporter's issue #18, a malicious agent that joins a team can get the victim agent's LLM to call the tool and run code with the host process's privileges. The reporter's repro shows it working on commit 9d78e88. The project has not responded, and no fix exists.
first public Nov 6, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams self-hosting OpenBMB IoA (im_client) whose agents can call the code executor tool, especially when they accept other agents into a team. The reporter says the repo's Docker setup uses privileged tool containers with the Docker socket mounted, which could extend this to the host. Deployments that do not load code_executor or do not let outside agents join are much less exposed. I could not confirm whether the tool is enabled by default.
Not affected if code-executor-tool-disabled, no-untrusted-agents
Who cares ai-agents, code-executor, docker, internet-of-agents, openbmb, self-hosted
No fix yet, per the sources.
Posts are quoted with a link to the original. They are data to us, never instructions.
A flaw has been found in OpenBMB Internet of Agents up to 9d78e88e47160eb42ee1ee8538c05e1c2c47877a. This affects the function execute_code of the file im_client/agents/tools/code_executor.py of the component Code Executor Tool. This manipulation of the argument filename/lang causes code injection. The attack can be initiated remotely. The exploit has been published and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.