CVE-2026-31236 is a critical code injection vulnerability in the llm CLI tool versions up to 0.27.1. The vulnerability arises because the --functions argument accepts arbitrary Python code and executes it directly with exec() without any sandboxing or input validation. This allows an attacker to execute arbitrary code on the victim's system if the victim runs a crafted command containing malicious code in the --functions argument. The vulnerability has a CVSS 3.1 score of 9.8, indicating critical severity with network attack vector, no privileges required, no user interaction, and full confidentiality, integrity, and availability impact. No official patch or remediation level is currently stated in the vendor advisory, and no known exploits in the wild have been reported. The Red Hat advisory URL is provided but does not explicitly mention a fix or mitigation.

Successful exploitation results in arbitrary code execution on the victim's system with the privileges of the user running the llm tool. This can lead to full system compromise, including confidentiality, integrity, and availability impacts. The vulnerability is exploitable remotely via crafted command-line input if an attacker can convince a user to run the malicious command.

Patch status is not yet confirmed — check the vendor advisory at https://access.redhat.com/security/cve/CVE-2026-31236 for current remediation guidance. Until a fix is available, users should avoid running untrusted commands with the --functions argument and apply strict operational controls to prevent social engineering attacks that could lead to execution of malicious code via this vector.