CVE-2026-90691
HighCVSS 8.3Summary
A security vulnerability has been detected in 0x4m4 HexStrike AI in the FileOperationsManager function of hexstrike_server.py (API Files Endpoint component). Manipulation of the filename argument leads to path traversal. The attack may be initiated remotely and the exploit has been publicly disclosed.
Risk Assessment
The path traversal vulnerability may allow access to files outside the intended directory, potentially exposing sensitive data. The public exploit increases the risk of exploitation.
Recommendation
Patch hexstrike_server.py as soon as possible by validating the filename argument and restricting access paths. Until then, disable or restrict access to the API Files Endpoint.
Other vulnerabilities in HexStrike AI
See all- CVE-2026-90690High
A weakness has been identified in 0x4m4 HexStrike AI in the subprocess.Popen function of hexstrike_server.py (API Tools Endpoint component). Manipulation of the additional_args/target/username/password/scan_type/payload arguments can lead to OS command injection. The attack can be launched remotely and the exploit has been made available to the public.
- CVE-2026-90620High
A missing authentication vulnerability was determined in 0x4m4 HexStrike AI up to commit d689933ff579d839c676c82b231f8e98326c5f04, in an unknown function of hexstrike_server.py (API Command Endpoint component). The manipulation causes missing authentication. The attack can be initiated remotely and the exploit has been publicly disclosed. The product uses rolling releases, so no version details are available.
- CVE-2026-90619High
An OS command injection vulnerability was found in 0x4m4 HexStrike AI up to commit d689933ff579d839c676c82b231f8e98326c5f04, in an unknown function of hexstrike_server.py (Execute Endpoint component). Manipulating the code/script argument leads to command injection. The attack is possible remotely and the exploit has been disclosed publicly. The product uses rolling releases, so no version details are available.
Original NVD description (English source)
A security vulnerability has been detected in 0x4m4 HexStrike AI up to d689933ff579d839c676c82b231f8e98326c5f04. The impacted element is the function FileOperationsManager of the file hexstrike_server.py of the component API Files Endpoint. The manipulation of the argument filename leads to path traversal. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.