CVE-2026-51857: Pypi/camel-ai vulnerability

Published Sep 30, 2026

Updated

In camel-ai camel 0.2.91a1, v0.2.91a2 and v0.2.91a3, CodeExecutionToolkit can run model-produced Python code through SubprocessInterpreter without an approval boundary.

Affected Software

1 affected component

pypi/camel-ai=0.2.91a1, =0.2.91a2, =0.2.91a3

Event History

Sep 30, 2026

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·09:17 PM

Description

Frequently Asked Questions

Which deployments are exposed?

Deployments using camel-ai versions 0.2.91a1, v0.2.91a2, or v0.2.91a3 are exposed when they use CodeExecutionToolkit with SubprocessInterpreter to execute model-produced Python.

What is required for exploitation?

An attacker would need to cause the model to produce Python code that reaches CodeExecutionToolkit and is run through SubprocessInterpreter. The affected path has no approval boundary before execution.

How can I determine whether my environment is affected?

Check whether the installed camel-ai version is 0.2.91a1, v0.2.91a2, or v0.2.91a3, and review whether CodeExecutionToolkit is configured to use SubprocessInterpreter. The provided information does not establish whether this configuration is enabled by default.

CVE-2026-51857: Pypi/camel-ai vulnerability

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed?

What is required for exploitation?

How can I determine whether my environment is affected?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

What is required for exploitation?

How can I determine whether my environment is affected?