CVE-2026-91140: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in Progress Software Autonomous REST Connector GenAI Agents

This vulnerability (CVE-2026-91140) involves improper neutralization of special elements used in OS commands (CWE-78) within the shell-based temporary-file cleanup process of Progress Software Autonomous REST Connector GenAI Agents version 2.0. An attacker who provides a maliciously crafted Swagger/OpenAPI document can trigger arbitrary command execution on the developer's machine during generator invocation. The vulnerability affects versions >=2.0 and <2.1 and has a CVSS 3.1 base score of 9.6, indicating critical severity with network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows remote attackers to execute arbitrary OS commands on a developer's machine, potentially leading to full system compromise, data theft, or disruption of services. The vulnerability impacts confidentiality, integrity, and availability at a high level.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid invoking the generator with untrusted Swagger/OpenAPI documents to prevent exploitation.