AgenticSeek contains an unauthenticated remote code execution flaw that allows an attacker to run arbitrary commands on the host. The vulnerability stems from an unprotected POST /query endpoint listening on all interfaces (0.0.0.0:7777). By sending crafted queries, an attacker can trigger the autonomous agent to execute shell code through BashInterpreter that calls subprocess.Popen with shell=True and safety=False, bypassing an incomplete command blocklist. The flaw is classified as CWE-306, reflecting a failure to enforce proper authentication, and results in full host‑level compromise when exploited.

The affected product is Fosowl’s AgenticSeek, with the vulnerability present in the commit fc242c7 and any releases that have not applied this fix. The software binds the vulnerable endpoint to all network interfaces on port 7777, exposing it to any network‑adjacent host that can reach that port. No specific version range is listed, so all deployments of AgenticSeek that include the unmodified code are potentially affected.

The CVSS score of 9.3 indicates critical severity. While the EPSS score is unavailable, the lack of a KEV listing suggests no confirmed widespread exploitation yet, but the architecture of the flaw makes it straightforward to craft an exploit. Because authentication is bypassed, any host on the same network can send a POST request to /query with a payload that triggers the vulnerable subprocess call, and the agent will execute the supplied shell command with system privileges. Security teams should treat this as an immediate risk and prioritize mitigation.