GHSA-h24f-gp4c-8qjm: taOS: Authenticated Non-Admin Host Code Execution via Skill Runtime
taOS is a self-hosted AI agent OS. Prior to version 1.0.0-beta.23, the POST /api/skill-exec/{skillid}/call endpoint in taOS executes built-in skills — including the codeexec skill which runs arbitrary Python via subprocess.run(["python3", "-c", code]) — without performing any admin role check, skill ownership check, or agent assignment verification. Any authenticated non-admin user can supply attacker-controlled Python code in the request body and have it executed as the taOS backend process user on the host, achieving full remote code execution with no privilege escalation required beyond a valid (non-admin) session. This issue has been patched in version 1.0.0-beta.23.
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated non-admin taOS user can exploit it. The vulnerable endpoint does not require an administrator role, ownership of the skill, or assignment of the skill to the user's agent.
What access does an attacker need to execute code?
The attacker needs a valid authenticated non-admin session and the ability to send a request to the POST /api/skill-exec/{skill_id}/call endpoint. They can provide Python code in the request body through the built-in code_exec skill.
What level of access does successful exploitation provide?
Attacker-supplied Python executes as the taOS backend process user on the host. This provides remote code execution without requiring an additional privilege escalation beyond the authenticated session.
Which versions are affected and how can the issue be remediated?
Versions prior to 1.0.0-beta.23 are affected. Upgrade to version 1.0.0-beta.23, which includes the patch.