---
id: "CVE-2026-123675"
page: "https://infrastack.ai/live/CVE-2026-123675"
kind: "vulnerability"
aliases: ["CVE-2026-123675"]
title: "OpenBMB IoA: code_executor tool runs agent-supplied code and file paths with no sandbox"
severity: "high"
cvss: 8.3
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: [{"name": "OpenBMB/IoA", "fixed": [], "affected": "main up to and including 9d78e88e47160eb42ee1ee8538c05e1c2c47877a (rolling releases, no versions)", "ecosystem": "github"}]
ecosystems: []
tags: ["ai-agents", "ai-tooling", "code-executor", "docker", "internet-of-agents", "openbmb", "self-hosted"]
not_affected_if: ["code-executor-tool-disabled", "no-untrusted-agents"]
published_at: "2026-11-06T16:17:54+00:00"
first_seen_at: "2026-11-06T16:42:41+00:00"
updated_at: "2026-11-06T16:46:07+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123675", "first_seen_at": "2026-11-06T16:42:41+00:00"}, {"source": "analyst", "url": "https://github.com/OpenBMB/IoA/issues/18", "first_seen_at": "2026-11-06T16:46:07+00:00", "cites": ["https://github.com/OpenBMB/IoA/issues/18", "https://github.com/OpenBMB/IoA/blob/main/im_client/agents/tools/code_executor.py"]}]
exploit_sources: []
---

# OpenBMB IoA: code_executor tool runs agent-supplied code and file paths with no sandbox

Link for people: https://infrastack.ai/live/CVE-2026-123675 (this .md is for agents)

In OpenBMB IoA (Internet of Agents), execute_code in im_client/agents/tools/code_executor.py is documented as running in Docker but runs a local subprocess. The filename argument is joined to the work dir without sanitization, so ../ writes files outside it. The lang argument maps to local bash/sh/powershell. Per the reporter's issue #18, a malicious agent that joins a team can get the victim agent's LLM to call the tool and run code with the host process's privileges. The reporter's repro shows it working on commit 9d78e88. The project has not responded, and no fix exists.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- github:OpenBMB/IoA affected main up to and including 9d78e88e47160eb42ee1ee8538c05e1c2c47877a (rolling releases, no versions) fixed no fixed version listed

## How to check

- Check whether your IoA checkout contains im_client/agents/tools/code_executor.py and whether the tool is registered in TOOL_MAPPING in im_client/agents/tools/__init__.py or in an agent's tool config. If so, run git log to see whether your commit is 9d78e88 or later (there are no release versions).
- Also check whether your docker-compose runs tool containers with privileged: true or mounts /var/run/docker.sock, as the reporter says the provided setup does.
- Whether the tool is on by default is not confirmed.

## Timeline

- 2026-11-06T16:42:41+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123675
- 2026-11-06T16:46:07+00:00 analyst https://github.com/OpenBMB/IoA/issues/18 — Read the reporter's GitHub issue OpenBMB/IoA#18 (open since 2026-10-14, no maintainer reply) and the current code_executor.py: unsanitized filename and lang confirmed in code. NVD page was empty via web-cli. Rolling releases, so no fixed version; fix-status none rests on the open issue, which is the reporter's, not the vendor's, so nothing is marked verified. Exploit is the issue's repro steps, not a standalone PoC; exploited in the wild not observed. Default-enablement unknown. X skipped (not queried). Severity unchanged.

## Documents

- [advisory] OpenBMB/IoA #18: code_executor tool runs unsandboxed https://github.com/OpenBMB/IoA/issues/18
- [describes] IoA code_executor.py (main) https://github.com/OpenBMB/IoA/blob/main/im_client/agents/tools/code_executor.py

## From the sources

A flaw has been found in OpenBMB Internet of Agents up to 9d78e88e47160eb42ee1ee8538c05e1c2c47877a. This affects the function execute_code of the file im_client/agents/tools/code_executor.py of the component Code Executor Tool. This manipulation of the argument filename/lang causes code injection. The attack can be initiated remotely. The exploit has been published and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_