CVE-2026-90621: HackingBuddyGPT OS Command Injection RCE

CVE-2026-90621 Overview

CVE-2026-90621 is an OS command injection vulnerability in ipa-lab HackingBuddyGPT versions up to 0.5.0. The flaw resides in the ssh_run_command function within src/hackingBuddyGPT/extensions/ssh_run_command.py. Attackers with low-privileged network access can manipulate command inputs to inject arbitrary operating system commands on the target host. The weakness is classified under [CWE-77] (Improper Neutralization of Special Elements Used in a Command). Public exploit details are available through VulDB, and the maintainers were notified via a GitHub issue but have not yet responded. The vulnerability affects the confidentiality, integrity, and availability of the host running the affected function.

Critical Impact
Authenticated remote attackers can inject arbitrary OS commands through the ssh_run_command function, resulting in unauthorized command execution on systems running HackingBuddyGPT.

Affected Products

ipa-lab HackingBuddyGPT versions up to and including 0.5.0
Component: src/hackingBuddyGPT/extensions/ssh_run_command.py
Function: ssh_run_command

Discovery Timeline

2026-09-14 - CVE-2026-90621 published to the National Vulnerability Database (NVD)
2026-09-15 - Last updated in NVD database
Project maintainers notified through GitHub Issue #150 with no response at time of disclosure

Technical Details for CVE-2026-90621

Vulnerability Analysis

The vulnerability exists in the ssh_run_command function of HackingBuddyGPT, an LLM-driven security testing tool. The function accepts input that is passed to an underlying command execution context without sufficient neutralization of shell metacharacters. An attacker who can influence the command string can append or substitute additional operating system commands. Because HackingBuddyGPT is designed to interact with target systems over SSH, the impact extends to any host the tool is authorized to reach. The exploit is publicly documented on VulDB, increasing the likelihood of opportunistic abuse. Exploitation requires low-privileged access, which limits but does not eliminate the risk in shared or multi-user deployments.

Root Cause

The root cause is improper neutralization of special elements used in an OS command [CWE-77]. The ssh_run_command function concatenates or forwards user-influenced input into a shell execution path without escaping metacharacters such as ;, &&, |, or backticks. When the resulting string is executed, injected fragments are interpreted as separate commands by the shell.

Attack Vector

The attack vector is network-based and requires low privileges with no user interaction. An attacker who can supply input to the ssh_run_command function, either directly through an exposed interface or indirectly through LLM-generated prompts routed to the function, can inject shell commands. Since HackingBuddyGPT executes commands against SSH-reachable targets, injected payloads run in the context of the executing process or the remote SSH session, depending on deployment.

No verified proof-of-concept code has been published in the reference set. Technical details are tracked in VulDB Vulnerability #403203 and the GitHub Issue #150.

Detection Methods for CVE-2026-90621

Indicators of Compromise

Unexpected child processes spawned by the Python interpreter running HackingBuddyGPT, particularly shells such as /bin/sh or /bin/bash with unusual arguments.
SSH sessions initiated by HackingBuddyGPT that execute chained commands containing metacharacters like ;, &&, ||, |, or backticks.
Log entries from ssh_run_command invocations containing suspicious input patterns or encoded payloads.

Detection Strategies

Instrument the ssh_run_command function with input logging to capture the raw command string prior to execution.
Deploy behavioral endpoint monitoring on hosts running HackingBuddyGPT to identify anomalous process trees originating from the Python runtime.
Review SSH server logs on target systems for command patterns that deviate from expected HackingBuddyGPT operations.

Monitoring Recommendations

Alert on any HackingBuddyGPT process spawning unexpected binaries such as nc, curl, wget, or reverse shell helpers.
Track outbound network connections from systems hosting HackingBuddyGPT to non-approved destinations.
Monitor commits and issues on the HackingBuddyGPT GitHub repository for an upstream patch.

How to Mitigate CVE-2026-90621

Immediate Actions Required

Restrict access to HackingBuddyGPT deployments to trusted operators only and remove any network exposure of the tool's control interfaces.
Run HackingBuddyGPT in an isolated environment such as a dedicated container or virtual machine to limit blast radius from injected commands.
Audit historical logs of ssh_run_command invocations for evidence of injection attempts.

Patch Information

At the time of publication, no vendor patch is available. The maintainers were informed through GitHub Issue #150 but have not yet responded. Monitor the HackingBuddyGPT repository for updates beyond version 0.5.0.

Workarounds

Modify local deployments of ssh_run_command to validate input against a strict allowlist of expected characters and reject shell metacharacters.
Use parameterized SSH command execution APIs that pass arguments as a list rather than concatenating into a shell string.
Enforce least-privilege credentials on the SSH targets so that injected commands execute with limited authority.
Deploy mandatory access controls such as AppArmor or SELinux profiles around the HackingBuddyGPT process to restrict which binaries can be executed.

bash

# Example hardening: run HackingBuddyGPT inside a restricted container
docker run --rm -it \
  --read-only \
  --cap-drop=ALL \
  --network=restricted-net \
  --user 1000:1000 \
  hackingbuddygpt:0.5.0