CVE-2026-8210: tgpt Command Injection RCE Vulnerability

CVE-2026-8210 Overview

CVE-2026-8210 is a command injection vulnerability in the aandrew-me tgpt command-line client, affecting versions up to 2.11.1 on Linux and macOS. The flaw resides in the helper.Update function within helper.go, part of the Update Handler component. An attacker with local access can manipulate input passed to this function to inject and execute arbitrary commands. The vulnerability is classified under CWE-74 (Improper Neutralization of Special Elements in Output). The exploit details have been publicly disclosed. According to NVD, the vendor was contacted prior to disclosure but did not respond.

Critical Impact

A locally authenticated attacker can inject operating system commands through the update handler in tgpt versions up to 2.11.1, leading to arbitrary command execution under the privileges of the invoking user.

Affected Products

• aandrew-me tgpt versions up to and including 2.11.1
• tgpt running on Linux distributions
• tgpt running on macOS

Discovery Timeline

• 2026-05-09 - CVE-2026-8210 published to the National Vulnerability Database
• 2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-8210

Vulnerability Analysis

The vulnerability exists in the helper.Update function defined in helper.go, which is part of the Update Handler component of tgpt. The function does not adequately neutralize special elements before passing data to a downstream command interpreter. This corresponds to [CWE-74], the improper neutralization of input that is later interpreted as a command or directive.

Because tgpt is a terminal client used to interact with large language model providers, the update routine likely invokes system shell utilities to download or replace the binary. Inadequate sanitization at this boundary allows shell metacharacters to break out of the intended command context.

The attack requires local access and low privileges. Successful exploitation results in command execution under the same security context as the user running the update operation.

Root Cause

The root cause is improper input neutralization within helper.Update. Data flowing into a command-execution sink is not validated or escaped, permitting attacker-controlled content to be interpreted as additional shell instructions rather than as literal arguments.

Attack Vector

The attack vector is local. An attacker who can influence the input consumed by the update handler — for example through a controlled environment, a malicious file, or a tampered update source reachable from the local context — can trigger command injection when the user runs the update routine. No network access is required.

No verified proof-of-concept code is published in the NVD references. Technical details are available through the VulDB Vulnerability #362418 record and the associated VulDB CTI Report.

Detection Methods for CVE-2026-8210

Indicators of Compromise

• Unexpected child processes (for example /bin/sh, bash, curl, wget) spawned by the tgpt binary during or shortly after an update operation.
• Shell metacharacters such as ;, &&, |, or backticks present in arguments or environment variables passed to tgpt update flows.
• Outbound network connections initiated by processes whose parent is tgpt and that are not the expected update endpoint.

Detection Strategies

• Monitor process execution telemetry on Linux and macOS endpoints for tgpt spawning shell interpreters or download utilities.
• Audit command-line arguments and environment values passed to the helper.Update code path for shell metacharacters.
• Correlate file modifications under user-writable paths with tgpt execution events to spot replacement of the binary by injected commands.

Monitoring Recommendations

• Enable EDR process-tree logging on developer and engineer workstations where tgpt is commonly installed.
• Alert on any execution of tgpt with non-standard parent processes or from unusual paths.
• Track installations and versions of tgpt across the fleet to identify hosts still running 2.11.1 or earlier.

How to Mitigate CVE-2026-8210

Immediate Actions Required

• Inventory all Linux and macOS systems with tgpt installed and identify versions at or below 2.11.1.
• Restrict or disable the built-in update functionality until a fixed release is verified.
• Limit installation of tgpt to trusted users and least-privileged accounts to constrain the blast radius of local command execution.

Patch Information

At the time of NVD publication, no vendor-supplied patch is referenced. The CVE record notes that the maintainer did not respond to disclosure outreach. Monitor the VulDB Vulnerability #362418 record and the upstream project repository for an updated release beyond 2.11.1 that addresses the helper.Update input handling.

Workarounds

• Avoid invoking the built-in update command in tgpt; install and update the binary through trusted package managers or manual download with integrity verification.
• Run tgpt under a dedicated low-privilege account that has no access to sensitive files or credentials.
• Apply application allow-listing or mandatory access control profiles (AppArmor, SELinux) to constrain what processes tgpt may spawn.
• Remove tgpt from systems that do not require it until a fixed version is available.