CVE-2026-90690: HexStrike AI RCE Vulnerability

CVE-2026-90690 Overview

CVE-2026-90690 is an operating system command injection vulnerability [CWE-77] in 0x4m4 HexStrike AI up to commit d689933ff579d839c676c82b231f8e98326c5f04. The flaw resides in the subprocess.Popen call within hexstrike_server.py, part of the API Tools Endpoint component. Attackers can manipulate the additional_args, target, username, password, scan_type, or payload arguments to inject arbitrary operating system commands. The attack is executable remotely without authentication, and a public exploit has been released. HexStrike AI does not use versioning, so affected release ranges are not enumerated in the advisory.

Critical Impact

Unauthenticated remote attackers can execute arbitrary operating system commands on the host running the HexStrike AI server by injecting shell metacharacters into API request parameters.

Affected Products

• 0x4m4 HexStrike AI up to commit d689933ff579d839c676c82b231f8e98326c5f04
• Component: API Tools Endpoint in hexstrike_server.py
• Function: subprocess.Popen

Discovery Timeline

• 2026-09-14 - CVE-2026-90690 published to NVD
• 2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-90690

Vulnerability Analysis

HexStrike AI exposes an API Tools Endpoint that forwards user-supplied parameters into a subprocess.Popen invocation inside hexstrike_server.py. Because the parameters additional_args, target, username, password, scan_type, and payload are not sanitized or safely quoted before command construction, an attacker can embed shell metacharacters or additional arguments. The injected content is then executed by the underlying operating system with the privileges of the HexStrike server process.

The issue is classified under [CWE-77] (Improper Neutralization of Special Elements used in a Command). Because HexStrike AI is a security tooling orchestrator, the server typically runs with broad permissions to invoke scanners and offensive utilities, amplifying the impact of successful injection.

Root Cause

The root cause is unsafe construction of a command line passed to subprocess.Popen. User input from API requests is concatenated into the command without input validation, allowlisting, or use of the argument-list form with shell=False. Any parameter reaching the process invocation can therefore extend or replace the intended command.

Attack Vector

The vulnerability is exploitable over the network with low attack complexity and no authentication or user interaction required. An attacker sends a crafted HTTP request to an exposed API Tools Endpoint, supplying shell metacharacters (such as ;, &&, |, or backticks) in one of the vulnerable parameters. The HexStrike server then spawns a process that executes the injected commands. A public exploit is referenced by the VulDB entry for CVE-2026-90690 and tracked in the upstream GitHub issue report.

The vulnerability manifests in the parameter-handling path leading to subprocess.Popen. See the GitHub pull request for the in-progress fix and details of the affected code path.

Detection Methods for CVE-2026-90690

Indicators of Compromise

• HTTP requests to HexStrike AI API Tools endpoints containing shell metacharacters (;, |, &, backticks, $()) in additional_args, target, username, password, scan_type, or payload parameters.
• Unexpected child processes spawned by the HexStrike server process, particularly shells (/bin/sh, bash) or network utilities (curl, wget, nc).
• Outbound network connections from the HexStrike host to previously unseen external addresses shortly after API requests.

Detection Strategies

• Inspect web server and application logs for API requests whose parameter values contain command separators or subshell syntax.
• Correlate HTTP request telemetry with process creation events on the HexStrike server host to detect anomalous descendants of the Python interpreter running hexstrike_server.py.
• Apply behavioral rules that alert on the HexStrike process spawning interactive shells or downloader utilities not associated with normal tool orchestration.

Monitoring Recommendations

• Enable verbose logging on the HexStrike API layer, including full request bodies, and forward logs to a centralized SIEM for retention and search.
• Monitor for new persistence artifacts (cron jobs, systemd units, SSH keys) on hosts running HexStrike AI.
• Track EPSS movement for CVE-2026-90690 (currently 1.35%, 70th percentile) alongside public exploit availability signals to prioritize response.

How to Mitigate CVE-2026-90690

Immediate Actions Required

• Remove the HexStrike AI API Tools Endpoint from any network segment reachable by untrusted clients, and place the server behind authenticated reverse-proxy controls.
• Rebuild or redeploy hosts suspected of exposure, given that arbitrary commands may have been executed with server privileges.
• Rotate credentials, API tokens, and SSH keys accessible from the HexStrike server host.

Patch Information

At the time of publication, the advisory states that a fix appears to be in progress. Track remediation status through the upstream GitHub pull request #266 and the GitHub issue #224. Because HexStrike AI does not use versioning, users should pin deployments to a commit hash that includes the merged fix once available.

Workarounds

• Restrict access to the HexStrike AI service using network ACLs, firewall rules, or VPN-only exposure until a patched commit is deployed.
• Front the API with an authenticating reverse proxy and strip or reject request parameters containing shell metacharacters.
• Run the HexStrike server as an unprivileged user inside a container with a read-only filesystem and no outbound internet access to limit blast radius.

# Example: restrict HexStrike API to a management subnet only
iptables -A INPUT -p tcp --dport 8888 -s 10.0.10.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8888 -j DROP