The flaw lies in the way the LLM tool named Sixth classifies commands as safe or unsafe before execution. The design allows the model to decide whether a command is safe, and only requires user approval for potentially destructive commands. Experienced attackers can inject prompts that trick the model into misclassifying a malicious instruction as safe. This misclassification bypasses the user approval gate and causes the tool to execute the command automatically. The vulnerability is an instance of OS Command Injection (CWE‑77) and can grant an attacker unrestricted ability to run arbitrary commands on the host system, jeopardizing confidentiality, integrity, and availability.

The issue impacts installations of the tool Sixth that have the automatic command execution feature enabled. No specific vendor, product, or version details are provided, so any deployment of Sixth carrying this feature is potentially exposed.

The vulnerability has a CVSS score of 9.8, indicating a very high severity. The EPSS score is below 1%, suggesting low current exploitation probability, yet the flaw remains practical for attackers skilled in prompt injection. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to supply a crafted prompt that influences the model’s safety classification logic, after which arbitrary shell commands are executed with the tool’s runtime privileges.