Description
A weakness has been identified in vxcontrol PentAGI up to 2.1.0. This affects an unknown part of the file backend/pkg/templates/prompts/pentester.tmpl of the component Tool Management Protocol Handler. Executing a manipulation can lead to sandbox issue. It is possible to launch the attack remotely. The attack requires a high level of complexity. It is indicated that the exploitability is difficult. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-08-03
Score: 6.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A vulnerability exists in vxcontrol PentAGI up to version 2.1.0 within the backend pkg templates for the pentester tool. Manipulation of the pentester.tmpl file may cause a sandbox escape. The weakness involves improper access controls and privilege management (CWE‑264; CWE‑265). An attacker could gain control outside the intended sandbox, potentially compromising system integrity and confidentiality.

Affected Systems

The affected product is vxcontrol PentAGI version 2.1.0 or earlier. The vulnerability resides in the file backend/pkg/templates/prompts/pentester.tmpl of the Tool Management Protocol Handler component. No other products or versions are listed.

Risk and Exploitability

The CVSS score is 6.3, indicating a moderate severity. EPSS data is unavailable, and the vulnerability is not listed in CISA's KEV catalog. The attack can be performed remotely, although the exploit requires a high level of complexity and is considered difficult. An exploit is publicly available, so administrators should treat this vulnerability as a moderate risk with a potentially long exposure window.

Generated by OpenCVE AI on August 4, 2026 at 10:31 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update PentAGI to version 2.1.1 or later when a vendor fix is released.
  • Restrict remote access to the Tool Management Protocol Handler using firewall or network ACLs.
  • Monitor system logs for abnormal manipulation attempts targeting the pentester.tmpl file.

Generated by OpenCVE AI on August 4, 2026 at 10:31 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 03 Aug 2026 11:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 03 Aug 2026 08:00:00 +0000

Type Values Removed Values Added
Description A weakness has been identified in vxcontrol PentAGI up to 2.1.0. This affects an unknown part of the file backend/pkg/templates/prompts/pentester.tmpl of the component Tool Management Protocol Handler. Executing a manipulation can lead to sandbox issue. It is possible to launch the attack remotely. The attack requires a high level of complexity. It is indicated that the exploitability is difficult. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Title vxcontrol PentAGI Tool Management Protocol pentester.tmpl sandbox
First Time appeared Vxcontrol
Vxcontrol pentagi
Weaknesses CWE-264
CWE-265
CPEs cpe:2.3:a:vxcontrol:pentagi:*:*:*:*:*:*:*:*
Vendors & Products Vxcontrol
Vxcontrol pentagi
References
Metrics cvssV2_0

{'score': 5.1, 'vector': 'AV:N/AC:H/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 5.6, 'vector': 'CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 5.6, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.3, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Vxcontrol Pentagi
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-03T10:20:37.359Z

Reserved: 2026-08-02T21:04:34.110Z

Link: CVE-2026-18593

cve-icon Vulnrichment

Updated: 2026-08-03T10:20:32.481Z

cve-icon NVD

Status : Deferred

Published: 2026-08-03T08:17:19.207

Modified: 2026-08-12T21:00:37.147

Link: CVE-2026-18593

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-04T10:45:05Z

Weaknesses