CVE-2026-25807: ZAI Shell RCE Vulnerability

CVE-2026-25807 Overview

CVE-2026-25807 is a command injection vulnerability in ZAI Shell, an autonomous SysOps agent designed to navigate, repair, and secure complex environments. Prior to version 9.0.3, the P2P terminal sharing feature (share start) opens a TCP socket on port 5757 without any authentication mechanism, allowing remote attackers to connect and inject arbitrary system commands.

Critical Impact

Remote attackers can execute arbitrary commands with user privileges by exploiting the unauthenticated P2P terminal sharing feature, potentially leading to complete system compromise.

Affected Products

• ZAI Shell versions prior to 9.0.3
• Systems with P2P terminal sharing enabled (share start)
• Instances running in --no-ai mode

Discovery Timeline

• 2026-02-09 - CVE-2026-25807 published to NVD
• 2026-02-10 - Last updated in NVD database

Technical Details for CVE-2026-25807

Vulnerability Analysis

This vulnerability stems from a fundamental authentication flaw in ZAI Shell's P2P terminal sharing implementation. When users initiate a terminal sharing session using the share start command, the application opens a TCP socket on port 5757 that accepts connections without requiring any form of authentication or authorization.

The attack requires network access to the vulnerable port and some user interaction. Specifically, when ZAI Shell operates in --no-ai mode, an attacker who connects to the P2P session can submit arbitrary system commands. If the legitimate host user approves these commands without reviewing their contents, the commands execute with the user's full privileges.

The vulnerability is classified as CWE-94 (Improper Control of Generation of Code), indicating that the application fails to properly validate or restrict the commands that can be injected through the P2P sharing mechanism. This effectively bypasses all Sentinel safety checks that would normally prevent unauthorized command execution.

Root Cause

The root cause of CVE-2026-25807 lies in the design decision to implement P2P terminal sharing without implementing proper authentication controls on the TCP socket listener. The share start functionality exposes port 5757 to network connections, treating all incoming connections as legitimate participants without verifying their identity or authorization status.

Additionally, the --no-ai mode disables AI-based safety controls that might otherwise detect and prevent malicious command patterns, creating a direct path for command injection when combined with user approval of unreviewed commands.

Attack Vector

The attack vector for this vulnerability is network-based and follows a multi-stage exploitation process:

1. Reconnaissance: The attacker identifies systems running ZAI Shell with active P2P terminal sharing sessions by scanning for open port 5757.

2. Connection: Using a simple socket script or network tool, the attacker establishes a connection to the exposed TCP port without any authentication challenge.

3. Command Injection: The attacker submits malicious system commands through the established connection.

4. Execution: When the legitimate host user approves the command queue without careful review, the injected commands execute with the user's privileges.

The attack is particularly dangerous in environments where users routinely approve pending commands without thorough inspection, which is common in high-volume operations scenarios. The vulnerability can be exploited to achieve remote code execution, data exfiltration, lateral movement, or persistent access.

Detection Methods for CVE-2026-25807

Indicators of Compromise

• Unexpected network connections to TCP port 5757 from unknown IP addresses
• Unusual command patterns or system commands in ZAI Shell logs that were not initiated by legitimate users
• Process execution anomalies originating from ZAI Shell parent processes
• Evidence of reconnaissance or port scanning activity targeting port 5757

Detection Strategies

• Deploy network monitoring to detect and alert on connections to port 5757 from unauthorized sources
• Implement log analysis rules to identify command injection patterns or suspicious command sequences in ZAI Shell audit logs
• Use endpoint detection solutions to monitor for unexpected child processes spawned by ZAI Shell
• Configure firewall rules to log and alert on attempts to access port 5757

Monitoring Recommendations

• Establish baseline network behavior for systems running ZAI Shell and alert on deviations
• Enable verbose logging for ZAI Shell sessions, particularly when P2P sharing is active
• Monitor for multiple failed or unusual connection attempts to the P2P sharing port
• Implement real-time alerting for command execution events that bypass normal approval workflows

How to Mitigate CVE-2026-25807

Immediate Actions Required

• Upgrade ZAI Shell to version 9.0.3 or later immediately
• Disable P2P terminal sharing (share start) on affected systems until patching is complete
• Block external access to TCP port 5757 using firewall rules
• Avoid using --no-ai mode in production environments until the patch is applied
• Review recent command history for any suspicious or unauthorized activity

Patch Information

The vulnerability has been fixed in ZAI Shell version 9.0.3. The patch addresses the authentication bypass by implementing proper access controls on the P2P terminal sharing socket. Organizations should update to this version immediately.

For detailed information on the fix, refer to the GitHub Commit and the GitHub Release v9.0.3. The GitHub Security Advisory GHSA-6pjj-r955-34rr provides additional technical details.

Workarounds

• Disable the P2P terminal sharing feature entirely by avoiding the share start command
• Implement network-level access controls to restrict port 5757 to trusted IP addresses only
• Always operate ZAI Shell with AI safety controls enabled (avoid --no-ai mode)
• Implement strict command review policies where users must manually inspect all pending commands before approval

# Firewall configuration to block external access to ZAI Shell P2P port
# For iptables-based systems
iptables -A INPUT -p tcp --dport 5757 -s 127.0.0.1 -j ACCEPT
iptables -A INPUT -p tcp --dport 5757 -j DROP

# For firewalld-based systems
firewall-cmd --permanent --add-rich-rule='rule family="ipv4" port port="5757" protocol="tcp" reject'
firewall-cmd --reload