CVE-2026-31236 describes a critical code injection vulnerability in the llm CLI tool versions up to 0.27.1. The vulnerability arises because the --functions argument accepts user-supplied Python code that is executed directly with exec() without any sanitization, sandboxing, or security controls. This design flaw allows an attacker to execute arbitrary code on a victim's system if the victim runs a crafted command containing malicious Python code in the --functions argument. The vulnerability enables full system compromise through arbitrary code execution. No CVSS score or official remediation details are provided, and the tool is not a cloud service.

Successful exploitation results in arbitrary code execution on the victim's system, potentially granting the attacker full control over the affected machine. This can lead to data compromise, system manipulation, or further attacks originating from the compromised host. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid running untrusted or unauthenticated commands using the llm CLI tool's --functions argument. Employ caution with any received commands or scripts that invoke this tool with custom function definitions. No vendor advisory or official fix information is currently provided.