Disclosure summary
Cybersecurity AI (CAI) is an open-source framework for building and deploying AI-powered offensive and defensive automation. Versions 0.5.9 and below are vulnerable to Command Injection through the run_ssh_command_with_credentials() function, which is available to AI agents. Only password and command inputs are escaped in run_ssh_command_with_credentials to prevent shell injection; while username, host and port values are injectable. This issue does not have a fix at the time of publication.
Source-reported weakness categories
CWE-77
Source-specific records & product guidance
Sources retain their own attribution and scoring. Follow the original record to confirm affected versions, fixed releases, and configuration conditions.
NIST National Vulnerability Database · NVD-CVE-2025-67511
Open original source · Updated Oct 08, 2026
Only CPE matches marked vulnerable=true are indexed. AND/OR platform conditions must be checked in the original NVD record.
| Vendor | Product / association | Version / bounds |
|---|---|---|
| aliasrobotics | cybersecurity_ai | * {"versionEndIncluding":"0.5.9"} |
Original records & references
- NIST NVD record
- CVE Program record
- github.com — Patch
- github.com — Exploit, Vendor Advisory
- www.hacktivesecurity.com — Exploit, Press/Media Coverage, Third Party Advisory
PUBLISHED 2025-12-10T19:16:22-05:00
MODIFIED 2026-10-08T06:10:00-04:00
INGESTED 2026-10-08T12:35:37-04:00