Threats tagged 'ghsa-jfpc-wj3m-qw2m'

The CAI framework's find_file tool has a command injection vulnerability due to unsanitized user input passed to a shell command with shell=True. This allows attackers to execute arbitrary commands by injecting malicious arguments such as the -exec flag. The vulnerability enables remote code execution without user approval, bypassing safety mechanisms. A patch exists but was not published to PyPI at the time of disclosure.