{"id":"CVE-2026-123675","kind":"vulnerability","aliases":["CVE-2026-123675"],"related":[],"title":"OpenBMB IoA: code_executor tool runs agent-supplied code and file paths with no sandbox","description":"A flaw has been found in OpenBMB Internet of Agents up to 9d78e88e47160eb42ee1ee8538c05e1c2c47877a. This affects the function execute_code of the file im_client/agents/tools/code_executor.py of the component Code Executor Tool. This manipulation of the argument filename/lang causes code injection. The attack can be initiated remotely. The exploit has been published and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.","summary":"In OpenBMB IoA (Internet of Agents), execute_code in im_client/agents/tools/code_executor.py is documented as running in Docker but runs a local subprocess. The filename argument is joined to the work dir without sanitization, so ../ writes files outside it. The lang argument maps to local bash/sh/powershell. Per the reporter's issue #18, a malicious agent that joins a team can get the victim agent's LLM to call the tool and run code with the host process's privileges. The reporter's repro shows it working on commit 9d78e88. The project has not responded, and no fix exists.","severity":"high","cvss":8.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"OpenBMB/IoA","fixed":[],"affected":"main up to and including 9d78e88e47160eb42ee1ee8538c05e1c2c47877a (rolling releases, no versions)","ecosystem":"github"}],"ecosystems":[],"tags":["ai-agents","ai-tooling","code-executor","docker","internet-of-agents","openbmb","self-hosted"],"not_affected_if":["code-executor-tool-disabled","no-untrusted-agents"],"how_to_check":"- Check whether your IoA checkout contains im_client/agents/tools/code_executor.py and whether the tool is registered in TOOL_MAPPING in im_client/agents/tools/__init__.py or in an agent's tool config. If so, run git log to see whether your commit is 9d78e88 or later (there are no release versions).\n- Also check whether your docker-compose runs tool containers with privileged: true or mounts /var/run/docker.sock, as the reporter says the provided setup does.\n- Whether the tool is on by default is not confirmed.","fix":null,"status":"open","published_at":"2026-11-06T16:17:54+00:00","first_seen_at":"2026-11-06T16:42:41+00:00","triaged_at":"2026-11-06T16:44:36+00:00","updated_at":"2026-11-06T16:46:07+00:00","category":"ai-tooling","confidence":0.75,"triage":{"at":"2026-11-06T16:44:36Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Internet of Agents: code executor tool lets remote users inject code","impact":"high","summary":"OpenBMB Internet of Agents has a code injection flaw in its Code Executor Tool, where the filename and language arguments of execute_code are not sanitized. A remote attacker can use it to run code of their choice on the host running the agent.","audience":"developers","category":"ai-tooling","nicknames":[],"who_cares":["internet-of-agents","openbmb","ai-agents","code-executor"],"confidence":0.6,"fix_status":"none","needs_auth":"unknown","worst_case":"Attacker runs arbitrary code on the agent host remotely.","analyst_note":"Find whether the project has released a fix or a stable version range, and confirm whether the code executor tool is enabled by default; check the NVD entry for the exploit reference.","how_to_check":"- Check whether the deployment includes `im_client/agents/tools/code_executor.py` from the Internet of Agents repository.\n- Confirm the exact commit in use; the sources say the affected range is up to `9d78e88e47160eb42ee1ee8538c05e1c2c47877a`.\n- Whether the code executor tool is enabled in your deployment: unknown.","plain_action":"","needs_analyst":true,"not_affected_if":["code-executor-tool-disabled"],"who_is_affected":"Teams running OpenBMB Internet of Agents with the Code Executor Tool present in im_client. The sources say the product uses rolling releases, so no affected or fixed version numbers are published, and the project has not responded to the report. Deployments that do not run this agent code path are likely not exposed, but the sources do not confirm which configurations enable the tool.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00075,"input_tokens":4337,"output_tokens":632,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find whether the project has released a fix or a stable version range, and confirm whether the code executor tool is enabled by default; check the NVD entry for the exploit reference.","search":"'-123675':19A,22A '-2026':18A,21A '18':92B '9d78e88':129B '9d78e88e47160eb42ee1ee8538c05e1c2c47877a':151C 'affect':153C,208C 'agent':8A,26B,37B,47B,95B,104B,148C 'agent-suppli':7A 'ai':25B,28B 'ai-ag':24B 'ai-tool':27B 'argument':66B,82B,173C 'attack':179C 'avail':213C 'bash/sh/powershell':86B 'call':108B 'caus':175C 'client/agents/tools/code_executor.py':52B,162C 'code':3A,10A,31B,49B,113B,157C,166C,176C 'code-executor':30B 'commit':128B 'compon':165C 'contini':193C 'cve':17A,20A 'deliveri':194C 'detail':206C 'dir':72B 'docker':33B,58B 'document':54B 'earli':221C 'execut':48B,156C 'executor':4A,32B,167C 'exist':138B 'exploit':185C 'file':12A,77B,160C 'filenam':65B 'filename/lang':174C 'fix':137B 'flaw':140C 'found':143C 'function':155C 'get':101B 'host':41B,116B 'im':51B,161C 'inform':217C 'initi':182C 'inject':177C 'internet':35B,45B,146C 'internet-of-ag':34B 'ioa':2A,44B 'issu':91B,224C 'join':68B,97B 'lang':81B 'llm':106B 'local':62B,85B 'malici':94B 'manipul':170C 'map':83B 'may':190C 'openbmb':1A,38B,43B,145C 'openbmb/ioa':23A 'outsid':78B 'path':13A 'per':87B 'privileg':119B 'problem':220C 'process':117B 'product':202C 'project':131B,215C 'publish':188C 'releas':197C,211C 'remot':183C 'report':89B,121B,225C 'repro':123B 'respond':134B,229C 'roll':196C 'run':6A,56B,60B,112B 'sandbox':16A 'sanit':74B 'self':40B 'self-host':39B 'show':124B 'subprocess':63B 'suppli':9A 'team':99B 'therefor':203C 'tool':5A,29B,110B,168C 'updat':210C 'use':192C,199C 'version':205C 'victim':103B 'without':73B 'work':71B,126B 'write':76B 'yet':230C","nicknames":[],"mitigations":[],"who_affected":"Teams self-hosting OpenBMB IoA (im_client) whose agents can call the code executor tool, especially when they accept other agents into a team. The reporter says the repo's Docker setup uses privileged tool containers with the Docker socket mounted, which could extend this to the host. Deployments that do not load code_executor or do not let outside agents join are much less exposed. I could not confirm whether the tool is enabled by default.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":["openbmbioa"],"ptokens":["ioa","openbmb"],"labels":["aiagents","aitooling","codeexecutor","docker","high","internetofagents","openbmb","selfhosted"],"campaign_type":null,"search_a":"'-123675':19A,22A '-2026':18A,21A 'agent':8A 'agent-suppli':7A 'code':3A,10A 'cve':17A,20A 'executor':4A 'file':12A 'ioa':2A 'openbmb':1A 'openbmb/ioa':23A 'path':13A 'run':6A 'sandbox':16A 'suppli':9A 'tool':5A","search_b":"'18':92B '9d78e88':129B 'agent':26B,37B,47B,95B,104B 'ai':25B,28B 'ai-ag':24B 'ai-tool':27B 'argument':66B,82B 'bash/sh/powershell':86B 'call':108B 'client/agents/tools/code_executor.py':52B 'code':31B,49B,113B 'code-executor':30B 'commit':128B 'dir':72B 'docker':33B,58B 'document':54B 'execut':48B 'executor':32B 'exist':138B 'file':77B 'filenam':65B 'fix':137B 'get':101B 'host':41B,116B 'im':51B 'internet':35B,45B 'internet-of-ag':34B 'ioa':44B 'issu':91B 'join':68B,97B 'lang':81B 'llm':106B 'local':62B,85B 'malici':94B 'map':83B 'openbmb':38B,43B 'outsid':78B 'per':87B 'privileg':119B 'process':117B 'project':131B 'report':89B,121B 'repro':123B 'respond':134B 'run':56B,60B,112B 'sanit':74B 'self':40B 'self-host':39B 'show':124B 'subprocess':63B 'team':99B 'tool':29B,110B 'victim':103B 'without':73B 'work':71B,126B 'write':76B","search_c":"'9d78e88e47160eb42ee1ee8538c05e1c2c47877a':151C 'affect':153C,208C 'agent':148C 'argument':173C 'attack':179C 'avail':213C 'caus':175C 'client/agents/tools/code_executor.py':162C 'code':157C,166C,176C 'compon':165C 'contini':193C 'deliveri':194C 'detail':206C 'earli':221C 'execut':156C 'executor':167C 'exploit':185C 'file':160C 'filename/lang':174C 'flaw':140C 'found':143C 'function':155C 'im':161C 'inform':217C 'initi':182C 'inject':177C 'internet':146C 'issu':224C 'manipul':170C 'may':190C 'openbmb':145C 'problem':220C 'product':202C 'project':215C 'publish':188C 'releas':197C,211C 'remot':183C 'report':225C 'respond':229C 'roll':196C 'therefor':203C 'tool':168C 'updat':210C 'use':192C,199C 'version':205C 'yet':230C","first_public_at":"2026-11-06T16:17:54+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123675","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123675","severity":null,"published_at":"2026-11-06T16:17:54+00:00","modified_at":"2026-11-06T16:17:54+00:00","first_seen_at":"2026-11-06T16:42:41+00:00","fetched_at":"2026-11-06T16:42:41+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-123675:1910","url":"https://github.com/OpenBMB/IoA/issues/18","severity":null,"published_at":"2026-11-06T16:46:07+00:00","modified_at":"2026-11-06T16:46:07+00:00","first_seen_at":"2026-11-06T16:46:07+00:00","fetched_at":"2026-11-06T16:46:07+00:00","note":"Read the reporter's GitHub issue OpenBMB/IoA#18 (open since 2026-10-14, no maintainer reply) and the current code_executor.py: unsanitized filename and lang confirmed in code. NVD page was empty via web-cli. Rolling releases, so no fixed version; fix-status none rests on the open issue, which is the reporter's, not the vendor's, so nothing is marked verified. Exploit is the issue's repro steps, not a standalone PoC; exploited in the wild not observed. Default-enablement unknown. X skipped (not queried). Severity unchanged.","cites":["https://github.com/OpenBMB/IoA/issues/18","https://github.com/OpenBMB/IoA/blob/main/im_client/agents/tools/code_executor.py"]}],"documents":[{"id":87998,"url":"https://github.com/OpenBMB/IoA/issues/18","title":"OpenBMB/IoA #18: code_executor tool runs unsandboxed","kind":"issue","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":87999,"url":"https://github.com/OpenBMB/IoA/blob/main/im_client/agents/tools/code_executor.py","title":"IoA code_executor.py (main)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}