CVE-2026-5594
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
Code injection vulnerability in premAI-io premsql up to version 0.2.1. The eval function in premsql/agents/baseline/workers/followup.py allows manipulation of the result argument, leading to code injection. Remote attack possible. Exploit published. Vendor unresponsive.
Risk Assessment
A remote attacker can execute arbitrary code on the server, potentially leading to full system compromise.
Recommendation
Immediately isolate the system and apply temporary security measures (e.g., firewall) until a patch is released by the vendor.
Original NVD description (English source)
A weakness has been identified in premAI-io premsql up to 0.2.1. Affected is the function eval of the file premsql/agents/baseline/workers/followup.py. This manipulation of the argument result causes code injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.