itamar-yochpaz/cve-2026-2256-pocProof-of-concept demonstrating a command injection vulnerability in MS-Agent Shell tool, enabling arbitrary command execution and reverse shell via Python bypass of security checks.
A critical command injection vulnerability (CVE-2026–2256, CVSS X.X) was identified in the Shell tool component of the MS-Agent framework version 1.5.2. The vulnerability arises from improper sanitization of user-influenced input that is passed directly to a shell execution context, enabling unintended command evaluation. An attacker can exploit this flaw by injecting crafted content into data sources consumed by the agent, such as prompts, documents, logs, or research inputs, without requiring direct shell access or explicit operator misuse. As a result, arbitrary commands can be executed with the privileges of the MS-Agent process on the host system as part of the agent's normal execution flow, potentially leading to full host compromise.
The Shell tool is an internal MS-Agent component that allows agents to execute operating system commands on the host. It is intended to support agent workflows such as file management, directory traversal, and automation tasks by delegating command execution to the underlying OS.
This simplified PoC shows how the check_safe() function in ms-agent's Shell tool can be bypassed to establish a reverse shell using Python.
nc (netcat)Run the PoC to verify the command bypasses security checks. Expected output: ✓ BYPASS SUCCESSFUL - the command passes all security checks
Open a NEW terminal window and run:
nc -l 1111
This starts a listener on port 1111. Leave this terminal open and waiting.
In your original terminal, run:
./reverse_shell_poc.py --execute
When prompted, type yes and press Enter.
Switch to the terminal with the netcat listener (from Step 2). You should now have a shell prompt!
Try commands like:
whoami - see your usernamepwd - see current directoryls - list filesexit - close the connectionpython3 to execute arbitrary codepython3 is NOT in the blocked commands listThe check_safe() function blocks commands like:
sudo, rm -rf /, chmod, curl | bash, etc.But it does NOT block:
python3 (arbitrary code execution)nc (netcat - network connections)perl, ruby, node (other interpreters)This demonstrates a CRITICAL vulnerability:
After testing, you can remove the test directory:
rm -rf /tmp/test_output
This is a localhost-only demonstration (connects to 127.0.0.1). This PoC intentionally avoids remote connectivity to reduce abuse risk.