CVE-2026-90618: GH05TCREW PentestAgent RCE Vulnerability

CVE-2026-90618 Overview

CVE-2026-90618 is an operating system command injection vulnerability [CWE-77] in GH05TCREW PentestAgent through commit cf882dabea3ed91cef016cdd115e5426315665a2. The flaw resides in the LocalRuntime.execute_command function within runtime/runtime.py, part of the LocalRuntime component. An attacker can manipulate input passed to this function to execute arbitrary operating system commands on the host running the agent. The attack is exploitable remotely and requires no authentication or user interaction. A public exploit has been released, and the pull request submitted to remediate the issue is still awaiting acceptance by the maintainers.

Critical Impact

Remote, unauthenticated attackers can inject arbitrary OS commands into the LocalRuntime.execute_command function, leading to code execution in the context of the PentestAgent process.

Affected Products

• GH05TCREW PentestAgent up to commit cf882dabea3ed91cef016cdd115e5426315665a2
• Component: LocalRuntime (runtime/runtime.py)
• Function: LocalRuntime.execute_command

Discovery Timeline

• 2026-09-14 - CVE-2026-90618 published to the National Vulnerability Database (NVD)
• 2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-90618

Vulnerability Analysis

The vulnerability is an OS command injection weakness classified under [CWE-77]. The LocalRuntime.execute_command function in runtime/runtime.py accepts input that is passed to an operating system command interpreter without adequate sanitization or argument separation. When attacker-controlled data reaches this function, shell metacharacters are interpreted by the underlying shell, allowing the attacker to append or chain additional commands. Because PentestAgent is designed to run offensive security tooling, the process typically executes with permissions sufficient to launch subprocesses, which magnifies the impact of successful injection. According to the Exploit Prediction Scoring System, the probability of exploitation is 1.6% (74.6th percentile) as of 2026-09-20.

Root Cause

The root cause is improper neutralization of special elements used in an OS command. The execute_command implementation constructs a command string from external input and hands it to a shell interpreter, rather than passing arguments as a discrete list to a subprocess call with shell invocation disabled. Any input containing characters such as ;, |, &&, backticks, or $( ) is parsed by the shell as command separators or substitutions.

Attack Vector

The attack is network-based and requires no privileges or user interaction. An adversary submits a crafted command payload to any interface that eventually reaches LocalRuntime.execute_command. The injected characters break out of the intended command context and cause the shell to execute additional operator-supplied commands. Because a proof-of-concept has been published, opportunistic scanning and exploitation of exposed PentestAgent instances is feasible. Refer to the GitHub PenTestAgent Issue #91 and VulDB CVE-2026-90618 entries for technical details.

Detection Methods for CVE-2026-90618

Indicators of Compromise

• Unexpected child processes spawned by the PentestAgent Python process, particularly shells such as /bin/sh, /bin/bash, cmd.exe, or powershell.exe executing commands unrelated to configured pentest tasks.
• Process command lines containing shell metacharacters (;, |, &&, `, $()) that originate from network-facing agent inputs.
• Outbound connections from the PentestAgent host to unfamiliar IP addresses or download of secondary payloads immediately following API requests to the runtime endpoint.

Detection Strategies

• Instrument or wrap LocalRuntime.execute_command with logging that captures the full argument string, source identifier, and caller context for offline review.
• Apply endpoint detection rules that alert on shell interpreters being spawned as children of the PentestAgent runtime process with arguments containing suspicious operators.
• Correlate HTTP or API request logs to the agent with subsequent process creation events to identify injection attempts.

Monitoring Recommendations

• Forward process creation telemetry (Sysmon Event ID 1, Linux execve auditing) from PentestAgent hosts to a central SIEM for correlation.
• Monitor file system writes to temporary directories and additions of persistence mechanisms such as cron jobs, systemd units, or scheduled tasks originating from the agent process.
• Track network egress from PentestAgent hosts and alert on connections to non-approved destinations.

How to Mitigate CVE-2026-90618

Immediate Actions Required

• Restrict network access to the PentestAgent service so it is reachable only from trusted management networks or over authenticated VPN.
• Stop or isolate any exposed PentestAgent instances running at or before commit cf882dabea3ed91cef016cdd115e5426315665a2 until a fix is applied.
• Review process execution and access logs on affected hosts for evidence of prior exploitation.

Patch Information

At the time of publication, no maintainer-accepted patch release is available. A remediation pull request has been submitted upstream and is awaiting acceptance. Track GitHub PenTestAgent Pull Request #100 and the GitHub PenTestAgent Repository for merge status, and apply the patch as soon as it is merged into a tagged release.

Workarounds

• Apply the pending upstream fix from pull request #100 as a local patch and rebuild the agent from source.
• Modify LocalRuntime.execute_command to invoke subprocesses with an argument list and shell=False, and validate inputs against a strict allowlist of expected commands.
• Run the agent under a dedicated, least-privileged service account and inside a container or sandbox to limit blast radius if injection succeeds.
• Place a reverse proxy or authentication layer in front of the agent's network interface to block unauthenticated access.

# Configuration example: restrict network exposure with iptables
iptables -A INPUT -p tcp --dport <pentestagent-port> -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport <pentestagent-port> -j DROP