An OS command injection vulnerability in the shell-based temporary-file cleanup instructions in Progress Software Autonomous REST Connector GenAI… (CVE-2026-91140)

This vulnerability (CVE-2026-91140) affects Progress Software Autonomous REST Connector GenAI Agents ARCGenAI-Generator version 2.0. The issue is an OS command injection in the shell-based temporary-file cleanup process triggered by crafted Swagger/OpenAPI documents. When a user runs the generator with such a malicious document, arbitrary commands can be executed on the developer's machine. The CVSS 3.1 score is 9.6 (critical), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows remote attackers to execute arbitrary OS commands on the developer's machine, potentially leading to full system compromise, data loss, or unauthorized access. The vulnerability affects the confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid processing untrusted Swagger/OpenAPI documents with the ARCGenAI-Generator version 2.0. Monitor vendor channels for updates and apply patches promptly once released.