Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2026-51881: Deeptutor 1.4.0 lets remote user run shell commands
CVE-2026-51881 · published 17 days ago
Summary
The live tutorbot feature in Deeptutor version 1.4.0 can be tricked into running any command on the server. This means someone outside your network could cause the software to execute harmful actions inside your environment. Update to a patched version or disable the live tutorbot interface until a fix is applied.
Original advisory text
deeptutor 1.4.0 contains code injection in ExecTool.execute. Through the live tutorbot WebSocket interface, a remote caller can induce the tool layer to execute reviewer-chosen shell commands in th...
deeptutor 1.4.0 contains code injection in ExecTool.execute. Through the live tutorbot WebSocket interface, a remote caller can induce the tool layer to execute reviewer-chosen shell commands in the service environment.
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Severity
9.8
Critical
Type
CWE-94Code Injection
Timeline
Published1 Oct 2026
Updated15 Oct 2026
First seen1 Oct 2026
Track software like this
Free during beta