CVE-2026-30631: Bytebot-ai RCE Vulnerability

CVE-2026-30631 Overview

CVE-2026-30631 is an OS command injection vulnerability [CWE-78] in the bytebot-ai project. The flaw resides in the computer_write_file function, which fails to sanitize path input supplied by an attacker. A remote, unauthenticated attacker can supply a crafted path value and achieve arbitrary code execution on the host running bytebot. The issue was introduced in commit 3d37894ce07ef8d8b40adc7fd309ad96c2a71313 dated 2025-09-11. The vulnerability is network-reachable, requires no privileges, and no user interaction.

Critical Impact
Unauthenticated attackers can execute arbitrary operating system commands on bytebot-ai hosts, resulting in full confidentiality, integrity, and availability compromise.

Affected Products

bytebot-ai bytebot at commit 3d37894ce07ef8d8b40adc7fd309ad96c2a71313 (2025-09-11)
Downstream forks or deployments built from the affected commit
Container images and desktop-agent builds packaging the vulnerable computer_write_file handler

Discovery Timeline

2026-07-21 - CVE-2026-30631 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-30631

Vulnerability Analysis

Bytebot-ai exposes an agent tool named computer_write_file that accepts a file path and payload from an upstream caller. The handler passes the caller-supplied path into an operating system command context without validation or safe argument construction. Because the path is interpolated into a shell-invoked operation, an attacker who controls the path field can inject additional shell metacharacters and commands. The result is arbitrary code execution in the context of the bytebot agent process. Public technical detail is available in the GitHub Gist Code Snippet and the GitHub Commit Details.

Root Cause

The root cause is improper neutralization of special elements used in an operating system command [CWE-78]. The computer_write_file code path concatenates untrusted input into a command string rather than using a safe file-write API or a parameterized argument array. Shell metacharacters such as ;, |, &&, backticks, and $() are preserved and executed by the underlying shell.

Attack Vector

An attacker reaches the vulnerable tool by sending a crafted request to any interface that forwards tool calls to the bytebot agent. Because bytebot-ai is designed to expose computer-use tools to LLM controllers and remote API clients, the tool call surface is network-reachable in typical deployments. The attacker submits a computer_write_file invocation whose path argument embeds shell command syntax, causing the bytebot process to execute the attacker-supplied commands with its own privileges.

Detection Methods for CVE-2026-30631

Indicators of Compromise

Unexpected child processes spawned by the bytebot agent process, especially shells (sh, bash, cmd.exe) invoked with concatenated arguments
computer_write_file tool calls containing shell metacharacters (;, |, &&, `, $()) in the path field
Outbound network connections initiated by the bytebot process to previously unseen destinations following file-write tool calls
New or modified files outside the intended bytebot working directory

Detection Strategies

Log and inspect all agent tool invocations, alerting on non-canonical path values submitted to computer_write_file
Baseline the process tree of the bytebot agent and flag deviations such as interpreter or downloader children (curl, wget, python, nc)
Correlate file-write tool calls with subsequent process creation events within a short time window

Monitoring Recommendations

Ingest bytebot application logs and host process telemetry into a centralized analytics store for cross-event correlation
Monitor egress from bytebot hosts, especially outbound shells and reverse-shell patterns
Track filesystem writes to sensitive locations such as /etc, ~/.ssh, cron directories, and Windows startup folders

How to Mitigate CVE-2026-30631

Immediate Actions Required

Identify all deployments built from commit 3d37894ce07ef8d8b40adc7fd309ad96c2a71313 or later commits that have not fixed computer_write_file
Restrict network access to bytebot agent endpoints to trusted callers only, using firewall rules or reverse-proxy authentication
Run the bytebot agent as a least-privileged, non-root user inside a container or sandbox with a read-only root filesystem where feasible
Review recent tool-call logs for suspicious computer_write_file invocations and rotate any credentials accessible to the agent process

Patch Information

No fixed release version is listed in the published NVD entry at the time of writing. Consult the upstream GitHub Commit Details and the bytebot-ai repository for remediation commits that replace shell-based file writes with safe filesystem APIs and validate path arguments against an allowlist.

Workarounds

Disable or remove the computer_write_file tool from the agent tool registry until a patched build is deployed
Wrap the tool handler with an input filter that rejects paths containing shell metacharacters or path-traversal sequences
Enforce a chroot or bind-mount jail so that bytebot file operations cannot escape a dedicated working directory
Apply mandatory access control profiles (AppArmor, SELinux) that deny process execution from the bytebot working directory

bash

# Example: block the vulnerable tool at the reverse proxy until patched
location /tools/computer_write_file {
    return 403;
}