CVE-2026-102874: HKUDS AnyTool Execute Endpoint main.py subprocess.run os command injection
A vulnerability was identified in HKUDS AnyTool 0.1.0. Affected is the function subprocess.run of the file anytool/localserver/main.py of the component Execute Endpoint. The manipulation of the argument command/shell leads to os command injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
The attack can be initiated remotely and requires no privileges or user interaction according to the supplied vector. Systems exposing the Execute Endpoint are therefore the relevant exposure population.
What capabilities does successful exploitation provide?
Manipulation of the command or shell argument reaches subprocess.run and results in OS command injection. The recorded impact includes partial compromise of confidentiality, integrity, and availability.
Is exploit code available?
Yes. A public exploit is available and may be used.
What versions are known to be affected?
HKUDS AnyTool 0.1.0 is identified as affected. No fixed version or workaround is provided in the available data.
Has the vendor responded to the report?
The project was notified early through an issue report, but no response had been received at the time of the report.