CVE-2026-5532
MediumCVSS 6.3Exploitation Probability (EPSS)
Elevated risk71th percentile - higher than 71% of all known CVEs
Summary
A vulnerability was detected in ScrapeGraphAI scrapegraph-ai up to version 1.74.0 allowing OS command injection via the create_sandbox_and_execute function in scrapegraphai/nodes/generate_code_node.py. The attack can be launched remotely and the exploit is publicly available. The vendor did not respond.
Risk Assessment
A remote attacker can execute arbitrary system commands on the server, potentially leading to full compromise of the application and data security.
Recommendation
Immediately disconnect the application from the network and contact the vendor for an update. Consider replacing the application with an alternative solution.
Original NVD description (English source)
A vulnerability was found in ScrapeGraphAI scrapegraph-ai up to 1.74.0. The affected element is the function create_sandbox_and_execute of the file scrapegraphai/nodes/generate_code_node.py of the component GenerateCodeNode Component. The manipulation results in os command injection. The attack may be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.