CVE-2026-90690: 0x4m4 HexStrike AI API Tools Endpoint hexstrike_server.py subprocess.Popen os command injection
A weakness has been identified in 0x4m4 HexStrike AI up to d689933ff579d839c676c82b231f8e98326c5f04. The affected element is the function subprocess.Popen of the file hexstrikeserver.py of the component API Tools Endpoint. Executing a manipulation of the argument additionalargs/target/username/password/scantype/payload can lead to os command injection. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. A fix appears to be in progress.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
An attacker can launch the attack remotely and does not need privileges or user interaction. Exploitation involves manipulating one of the API Tools Endpoint arguments: additional_args, target, username, password, scan_type, or payload.
Which deployments should be considered potentially affected?
0x4m4 HexStrike AI versions up to commit d689933ff579d839c676c82b231f8e98326c5f04 are identified as affected. Because the product does not use versioning, affected and unaffected releases cannot be determined from release numbers.
Is public exploitation material available?
Yes. Public exploit material is available, and the vulnerability is assessed as potentially usable in attacks.
What should teams do if a patch is not yet available?
A fix appears to be in progress. Until a fix is available, reduce exposure of the API Tools Endpoint, particularly remote access to endpoints that accept the affected arguments.