The CAI framework allows untrusted input to be passed unchanged to a shell command through subprocess.Popen with shell=True, enabling an attacker to inject arbitrary arguments such as "-exec" into the find_file tool. This results in Remote Code Execution on the host system, bypassing any human-in-the-loop safety mechanisms, and can compromise confidentiality, integrity, and availability of the platform. The weakness is a classic command injection scenario (CWE-78).

The vulnerability affects the aliasrobotics Cybersecurity AI (CAI) framework, versions up to and including 0.5.10. Users running these releases should verify the current commit hash against the patched revision highlighted in the advisory.

With a CVSS score of 9.7 and an EPSS of less than 1%, the exploit potential is high but relatively uncommon. The issue is not listed in the CISA KEV catalog. The likely attack vector involves supplying malicious arguments to the find_file tool, either through local user input if the tool is used directly or via a remote actor who can influence the input passed to CAI. No obvious prerequisites beyond the ability to control the argument list are required.