---
id: "CVE-2026-67547"
page: "https://infrastack.ai/live/CVE-2026-67547"
kind: "vulnerability"
aliases: ["CVE-2026-67547"]
title: "taOS: any logged-in user can run Python code on the host"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: []
ecosystems: []
tags: ["ai-agents", "ai-tooling", "self-hosted", "taos"]
not_affected_if: ["version-1.0.0-beta.23-or-later"]
published_at: "2026-11-11T22:17:29+00:00"
first_seen_at: "2026-11-11T22:29:35+00:00"
updated_at: "2026-11-11T22:31:15+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67547", "first_seen_at": "2026-11-11T22:29:35+00:00"}]
exploit_sources: []
---

# taOS: any logged-in user can run Python code on the host

Link for people: https://infrastack.ai/live/CVE-2026-67547 (this .md is for agents)

taOS, a self-hosted AI agent OS, lets any authenticated non-admin user call the skill execution endpoint and run arbitrary Python through its code_exec skill. The code runs as the taOS backend process user, so an attacker gets full remote code execution on the host.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the taOS version the instance runs; versions before `1.0.0-beta.23` are affected.
- Look for the endpoint `POST /api/skill-exec/{skill_id}/call` on the instance and whether non-admin accounts can reach it.

## Fix

- taOS: upgrade to `1.0.0-beta.23` or later.

## Timeline

- 2026-11-11T22:29:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-67547

## Documents

- [advisory] Vendor advisory: github.com https://github.com/jaylfc/taOS/security/advisories/GHSA-h24f-gp4c-8qjm
- [fix] Patch: github.com https://github.com/jaylfc/taOS/commit/8998d85190424d5e843880b4ca256e79b653a304
- [fix] Release notes: github.com https://github.com/jaylfc/taOS/releases/tag/v1.0.0-beta.23

## From the sources

taOS is a self-hosted AI agent OS. Prior to version 1.0.0-beta.23, the POST /api/skill-exec/{skill_id}/call endpoint in taOS executes built-in skills — including the code_exec skill which runs arbitrary Python via subprocess.run(["python3", "-c", code]) — without performing any admin role check, skill ownership check, or agent assignment verification. Any authenticated non-admin user can supply attacker-controlled Python code in the request body and have it executed as the taOS backend process user on the host, achieving full remote code execution with no privilege escalation required beyond a valid (non-admin) session. This issue has been patched in version 1.0.0-beta.23.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_