Log in Start free

Vulnerability · Published Apr 28, 2025 · Assigned by VulDB

CVE-2025-4032inclusionAI AWorld shell_tool.py subprocess.Popen os command injection

Medium 5.0

In plain English

A medium-severity OS command injection in AWorld from inclusionAI. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 3.3% (higher than 89% of all known vulnerabilities).

Severity (CVSS 3.1)5.0Medium
Exploit odds (30 days)3.3%top 11.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A vulnerability was found in inclusionAI AWorld up to 8c257626e648d98d793dd9a1a950c2af4dd84c4e. It has been rated as critical. This issue affects the function subprocess.run/subprocess.Popen of the file AWorld/aworld/virtual_environments/terminals/shell_tool.py. The manipulation leads to os command injection. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
PyPIaworldno fix listedGHSA-jmjf-mfhm-j3gf
PyPIaworldno fix listedPYSEC-2026-1204

Affected products (as reported)

VendorProductVersions
inclusionAI AWorld 8c257626e648d98d793dd9a1a950c2af4dd84c4e

Weakness: CWE-78, CWE-77 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L

References