Vulnerability · Published Sep 30, 2026 · Assigned by VulDB

CVE-2026-102874HKUDS AnyTool Execute Endpoint main.py subprocess.run os command injection

High 7.3

In plain English

A high-severity OS command injection in AnyTool from HKUDS. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 71% of all known vulnerabilities).

Severity (CVSS 3.1)7.3High

Exploit odds (30 days)1.3%top 29.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability was identified in HKUDS AnyTool 0.1.0. Affected is the function subprocess.run of the file anytool/local_server/main.py of the component Execute Endpoint. The manipulation of the argument command/shell leads to os command injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.

Affected products (as reported)

Vendor	Product	Versions
HKUDS	AnyTool	0.1.0

Weakness: CWE-78, CWE-77 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C

References

VDB-411510 | HKUDS AnyTool Execute Endpoint main.py subprocess.run os command injection vdb-entry, technical-description
VDB-411510 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
CVE-2026-102874 | CVE Analysis and Report third-party-advisory
Submit #949780 | HKUDS AnyTool 0.1.0 cwe-78 third-party-advisory
https://github.com/HKUDS/AnyTool/issues/6 exploit, issue-tracking
https://github.com/HKUDS/AnyTool/ product