CVE-2026-90690
HighCVSS 7.3Summary
A weakness has been identified in 0x4m4 HexStrike AI in the subprocess.Popen function of hexstrike_server.py (API Tools Endpoint component). Manipulation of the additional_args/target/username/password/scan_type/payload arguments can lead to OS command injection. The attack can be launched remotely and the exploit has been made available to the public.
Risk Assessment
OS command injection may allow arbitrary code execution on the server, leading to full system compromise. The public exploit increases the risk of attack.
Recommendation
Immediately patch hexstrike_server.py by avoiding passing user input to subprocess.Popen without validation. Until then, disable or restrict access to the API Tools Endpoint.
Other vulnerabilities in HexStrike AI
See all- CVE-2026-90691High
A security vulnerability has been detected in 0x4m4 HexStrike AI in the FileOperationsManager function of hexstrike_server.py (API Files Endpoint component). Manipulation of the filename argument leads to path traversal. The attack may be initiated remotely and the exploit has been publicly disclosed.
- CVE-2026-90620High
A missing authentication vulnerability was determined in 0x4m4 HexStrike AI up to commit d689933ff579d839c676c82b231f8e98326c5f04, in an unknown function of hexstrike_server.py (API Command Endpoint component). The manipulation causes missing authentication. The attack can be initiated remotely and the exploit has been publicly disclosed. The product uses rolling releases, so no version details are available.
- CVE-2026-90619High
An OS command injection vulnerability was found in 0x4m4 HexStrike AI up to commit d689933ff579d839c676c82b231f8e98326c5f04, in an unknown function of hexstrike_server.py (Execute Endpoint component). Manipulating the code/script argument leads to command injection. The attack is possible remotely and the exploit has been disclosed publicly. The product uses rolling releases, so no version details are available.
Original NVD description (English source)
A weakness has been identified in 0x4m4 HexStrike AI up to d689933ff579d839c676c82b231f8e98326c5f04. The affected element is the function subprocess.Popen of the file hexstrike_server.py of the component API Tools Endpoint. Executing a manipulation of the argument additional_args/target/username/password/scan_type/payload can lead to os command injection. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. A fix appears to be in progress.