CVE-2026-51857

CriticalCVSS 9.8

Published: 30/09/2026(UTC)Updated: 02/10/2026(UTC)Translated: 01/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.16%

4th percentile - higher than 4% of all known CVEs

Summary

In camel-ai camel 0.2.91a1, v0.2.91a2 and v0.2.91a3, CodeExecutionToolkit can run model-produced Python code through SubprocessInterpreter without an approval boundary. This enables execution of arbitrary code in the service environment.

Risk Assessment

An attacker can cause malicious Python code to be executed, risking system takeover or access to sensitive data. The lack of approval increases the risk of unintended or malicious execution.

Recommendation

Upgrade camel-ai to a version with an approval mechanism or disable code execution via CodeExecutionToolkit. Apply sandboxing for executed code.

Other vulnerabilities in camel-ai camel

CVE-2026-51858Low risk· EPSS 15%
In camel-ai camel 0.2.91a1, v0.2.91a2 and v0.2.91a3, TerminalToolkit.shell_exec allows prompt-driven shell command execution without an approval boundary. This means the model can initiate execution of arbitrary system commands.

Original NVD description (English source)

In camel-ai camel 0.2.91a1, v0.2.91a2 and v0.2.91a3, CodeExecutionToolkit can run model-produced Python code through SubprocessInterpreter without an approval boundary.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS