Vulnerability Report

CVE-2025-67511

RCE

Title: Command Injection in Cybersecurity AI (CAI) framework

RCE

Proof Of Concept

PoC Available for CVE-2025-67511

CWE Category CWE-77
Published Date Dec 11, 2025
Modified Date Mar 17, 2026
Exploit Status Available
Score 9.6 CVSS v3.1
Exploit Probability (EPSS)
1.52%

Vulnerability Summary

CVE-2025-67511: Cybersecurity AI (CAI) is an open-source framework for building and deploying AI-powered offensive and defensive automation. Versions 0.5.9 and below are vulnerable to Command Injection through the run_ssh_command_with_credentials() function, which is available to AI agents. Only password and command inputs are escaped in run_ssh_command_with_credentials to prevent shell injection; while username, host and port values are injectable. This issue does not have a fix at the time of publication.

Impacted Vendors

A
aliasrobotics 1

Reference Links

https://github.com/aliasrobotics/cai/commit/09ccb6e0baccf56c40e6cb429c698750843a999c https://github.com/aliasrobotics/cai/security/advisories/GHSA-4c65-9gqf-4w8h https://www.hacktivesecurity.com/blog/2025/12/10/cve-2025-67511-tricking-a-security-ai-agent-into-pwning-itself
CVSS v3.1
Source Entity [email protected]
Severity CRITICAL
9.6
Attack Vector
NETWORK
Complexity
LOW
Privileges
N/A
Interaction
REQUIRED
Confidentiality
N/A
Integrity
N/A
Availability
N/A
Scope
CHANGED
RAW VECTOR CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
CVSS v3.1
Source Entity [email protected]
Severity CRITICAL
9.6
Attack Vector
NETWORK
Complexity
LOW
Privileges
N/A
Interaction
REQUIRED
Confidentiality
N/A
Integrity
N/A
Availability
N/A
Scope
CHANGED
RAW VECTOR CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Associated Attack Patterns (CAPEC)

Total: Patterns

CVE-2025-67511 Exploits & PoCs (Proof Of Concept)

GitHub https://github.com/edoardottt/CVE-2025-67511
View Code
MODIFIED

Vulnerability data updated via NVD.

MODIFIED

Vulnerability data updated via NVD.

MODIFIED

Vulnerability data or affected products updated.

PUBLISHED

Vulnerability first announced in NVD.

Attack Vector Matrix

Access Vector NETWORK
Complexity LOW
Privileges N/A
Interaction REQUIRED
CVSS Vector String CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Affected Stack

No specific products linked.