Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2026-30631: bytebot-ai allows arbitrary code execution via file path
CVE-2026-30631 · published 3 months ago
Summary
A security issue in bytebot-ai allows attackers to run malicious code on the system. This means that if an attacker can manipulate the file path, they may be able to take control of the system or steal sensitive information. To stay safe, update bytebot-ai to the latest version or use a secure alternative.
Original advisory text
An issue was discovered in bytebot-ai in commit 3d37894ce07ef8d8b40adc7fd309ad96c2a71313 (2025-09-11) allowing attackers to execute arbitrary code via crafted path to `computer_write_file`.
An issue was discovered in bytebot-ai in commit 3d37894ce07ef8d8b40adc7fd309ad96c2a71313 (2025-09-11) allowing attackers to execute arbitrary code via crafted path to `computer_write_file`.
References
- https://gist.github.com/spdc-elm/1a56d53591a929446a54e50e64de9fc0 URL
- https://github.com/bytebot-ai/bytebot/commit/3d37894ce07ef8d8b40adc7fd309ad96c2a... Patch
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/30xxx/CVE-2026-30631... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-30631 Vendor Advisory
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Severity
9.8
Critical
Type
CWE-78OS Command Injection
Timeline
Published21 Jul 2026
Updated7 Nov 2026
First seen21 Jul 2026
Track software like this
Free during beta