Proof-of-concept demonstrating argument injection leading to OS command injection in the CAI framework's find_file utility, enabling arbitrary command execution and reverse shells.

The find_file function accepts an args parameter that is directly concatenated into a system-level find command without proper sanitization or argument validation.

This allows injection of arbitrary flags such as -exec, resulting in arbitrary OS command execution.

In autonomous or AI-agent-driven environments, this vulnerability may execute without human approval, significantly increasing its impact.

Impact

Successful exploitation allows an attacker to:

• Execute arbitrary system commands
• Read sensitive system or application data
• Create, modify, or delete files
• Establish reverse shells
• Abuse AI agents or automation pipelines

This is especially dangerous in AI-assisted security tooling, CI/CD environments, and autonomous agent workflows.

Proof of Concept

The included PoC script demonstrates the following scenarios:

Test 1 – Command Execution (whoami)

Executes the whoami command via argument injection using the -exec flag.

Test 2 – Non-destructive File Creation

Creates a proof marker file:

Test 3 – Reverse Shell (Commented Out)

A reverse shell payload is included in the script but commented out for safety and ethical reasons.

Usage

Requirements

• Python 3
• Vulnerable version of cai-framework (<= 0.5.10)
• Local execution environment (preferably isolated)

Running the PoC

Verification

If the system is vulnerable:

• Output of whoami will be displayed
• The marker file will be created

Verify manually:

If commands execute successfully, the vulnerability is confirmed.

Patch Status

The vulnerability was fixed after the following commit:

After applying the patch:

• Injection of -exec or similar arguments should be rejected
• Command execution attempts should fail

Users are strongly advised to upgrade immediately.

Mitigation Recommendations

• Strictly validate and whitelist allowed arguments
• Avoid passing user-controlled input to shell commands
• Use subprocess with argument arrays instead of shell execution
• Apply sandboxing for AI-agent tool execution
• Enforce human approval gates for high-risk actions

Responsible Disclosure

This vulnerability was discovered and responsibly disclosed by:

Mohammed Idrees Banyamer
Jordan
Instagram: @banyamer_security
GitHub: https://github.com/yourusername

Disclaimer

This Proof of Concept is provided for educational and defensive security purposes only.

Do NOT use this code against systems you do not own or have explicit permission to test.

The author assumes no liability for misuse or damages resulting from this code.

References

• Cybersecurity AI (CAI) Framework: https://github.com/aliasrobotics/cai
• CVE: CVE-2026-25130