OpenSRE 0.1.2026.10.19 contains a flaw that allows an attacker to bypass the approval gate and execute arbitrary shell commands through the shell_run function. The flaw stems from the headless presenter's execution_allowed() method always returning true, so any injected command received via alerts or Slack messages is run on the host. Successful exploitation can lead to execution of arbitrary code, exfiltration of the agent’s locally stored LLM, Slack, and cloud credentials, and potentially further compromise of the host environment.

The vulnerability is specific to Tracer-Cloud’s OpenSRE project, version 0.1.2026.10.19. No other vendors, products or versions are listed as affected in the CNA data. Users running this exact release should consider themselves at risk.

The CVSS score of 9.3 classifies this flaw as critical severity. The EPSS score of < 1% indicates a very low but nonzero probability of exploitation. It is not yet listed in CISA’s KEV catalog, suggesting no widespread observed incidents to date. The attack likely requires the ability to send crafted messages to the agent through the Slack integration or other alert channels, which may be remotely accessible. Based on the description, the likely attack vector is remote via message injection; however, the exact privileges required to write to the Slack channel or alert system are not specified.