A command injection flaw exists in GPT‑Pilot’s Executor.run() method. When the tool prompts the user to confirm or modify a command to be executed, it accepts arbitrary free‑text input without validation and passes it directly to asyncio.create_subprocess_shell(). This omission allows an attacker to replace or append shell commands, enabling remote code execution with the privileges of the running GPT‑Pilot process.

Versions of GPT‑Pilot up to and including the commit 0819827ce20346ef5f25b3fe29293cb448840565 (dated 2025‑09‑03) are affected. No additional vendors or products outside GPT‑Pilot are listed as impacted.

The CVSS score of 6.5 indicates medium severity. The EPSS score of <1% shows a low probability of exploitation, and the vulnerability is not in the CISA KEV catalog. An attacker can obtain remote code execution simply by inserting malicious commands at the execution confirmation prompt, without needing additional privileges beyond those granted to the GPT‑Pilot process.