CVE-2026-84888: RightNow-AI OpenFang tool_runner.rs shell_exec memory allocation
A weakness has been identified in RightNow-AI OpenFang up to 0.6.9. This vulnerability affects the function shellexec of the file crates/openfang-runtime/src/toolrunner.rs. This manipulation causes uncontrolled memory allocation. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
RightNow-AI OpenFang versions up to and including 0.6.9 are identified as affected. The issue is remotely exploitable in the shell_exec function of crates/openfang-runtime/src/tool_runner.rs.
What level of access does an attacker need?
The supplied severity vector indicates low privileges are required and no user interaction is required. The attack can be performed over the network.
What is the practical impact?
The flaw can cause uncontrolled memory allocation, with availability impact rated as low in the provided vector. No confidentiality or integrity impact is indicated.
How urgent is remediation?
Public exploit availability is reported, so affected deployments should be prioritized for remediation or exposure reduction. The vendor was contacted but did not respond, and no fixed version is provided in the available data.