CVE-2026-30306

{"dataType": "CVE_RECORD", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2026-30306", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2026-04-01T17:57:44.311Z", "dateReserved": "2026-03-04T00:00:00.000Z", "datePublished": "2026-03-30T00:00:00.000Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-03-30T20:04:26.731Z"}, "descriptions": [{"lang": "en", "value": "In its design for automatic terminal command execution, SakaDev offers two options: Execute safe commands and execute all commands. The description for the former states that commands determined by the model to be safe will be automatically executed, whereas if the model judges a command to be potentially destructive, it still requires user approval. However, this design is highly susceptible to prompt injection attacks. An attacker can employ a generic template to wrap any malicious command and mislead the model into misclassifying it as a 'safe' command, thereby bypassing the user approval requirement and resulting in arbitrary command execution."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://marketplace.visualstudio.com/items?itemName=rahmanazhar.saka-dev"}, {"url": "https://github.com/Secsys-FDU/LLM-Tool-Calling-CVEs/issues/4"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-94", "lang": "en", "description": "CWE-94 Improper Control of Generation of Code ('Code Injection')"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-04-01T17:56:08.488633Z", "id": "CVE-2026-30306", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-01T17:57:44.311Z"}}]}, "dataVersion": "5.2"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-30306", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-04-01T17:56:08.488633Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "CWE-94 Improper Control of Generation of Code ('Code Injection')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-01T17:57:26.971Z"}}], "cna": {"affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "references": [{"url": "https://marketplace.visualstudio.com/items?itemName=rahmanazhar.saka-dev"}, {"url": "https://github.com/Secsys-FDU/LLM-Tool-Calling-CVEs/issues/4"}], "descriptions": [{"lang": "en", "value": "In its design for automatic terminal command execution, SakaDev offers two options: Execute safe commands and execute all commands. The description for the former states that commands determined by the model to be safe will be automatically executed, whereas if the model judges a command to be potentially destructive, it still requires user approval. However, this design is highly susceptible to prompt injection attacks. An attacker can employ a generic template to wrap any malicious command and mislead the model into misclassifying it as a 'safe' command, thereby bypassing the user approval requirement and resulting in arbitrary command execution."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "n/a"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-03-30T20:04:26.731Z"}}}, "cveMetadata": {"cveId": "CVE-2026-30306", "state": "PUBLISHED", "dateUpdated": "2026-04-01T17:57:44.311Z", "dateReserved": "2026-03-04T00:00:00.000Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2026-03-30T00:00:00.000Z", "assignerShortName": "mitre"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "source": "cve@mitre.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:rahmanazhar:sakadev:*:*:*:*:*:visual_studio_code:*:*", "matchCriteriaId": "61C12248-1044-43FF-9188-AFDF2B53EA4F", "versionEndExcluding": "4.0.6", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In its design for automatic terminal command execution, SakaDev offers two options: Execute safe commands and execute all commands. The description for the former states that commands determined by the model to be safe will be automatically executed, whereas if the model judges a command to be potentially destructive, it still requires user approval. However, this design is highly susceptible to prompt injection attacks. An attacker can employ a generic template to wrap any malicious command and mislead the model into misclassifying it as a 'safe' command, thereby bypassing the user approval requirement and resulting in arbitrary command execution."}, {"lang": "es", "value": "En su dise\u00f1o para la ejecuci\u00f3n autom\u00e1tica de comandos de terminal, SakaDev ofrece dos opciones: Ejecutar comandos seguros y ejecutar todos los comandos. La descripci\u00f3n de la primera opci\u00f3n establece que los comandos que el modelo determine como seguros se ejecutar\u00e1n autom\u00e1ticamente, mientras que si el modelo juzga que un comando es potencialmente destructivo, a\u00fan requiere la aprobaci\u00f3n del usuario. Sin embargo, este dise\u00f1o es altamente susceptible a ataques de inyecci\u00f3n de *prompts*. Un atacante puede emplear una plantilla gen\u00e9rica para envolver cualquier comando malicioso y enga\u00f1ar al modelo para que lo clasifique err\u00f3neamente como un comando 'seguro', eludiendo as\u00ed el requisito de aprobaci\u00f3n del usuario y resultando en la ejecuci\u00f3n arbitraria de comandos."}], "id": "CVE-2026-30306", "lastModified": "2026-06-17T10:32:37.537", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-30306", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-04-01T17:56:08.488633Z", "version": "2.0.3"}}]}, "published": "2026-03-30T21:17:08.983", "references": [{"source": "cve@mitre.org", "tags": ["Mitigation", "Third Party Advisory"], "url": "https://github.com/Secsys-FDU/LLM-Tool-Calling-CVEs/issues/4"}, {"source": "cve@mitre.org", "tags": ["Product"], "url": "https://marketplace.visualstudio.com/items?itemName=rahmanazhar.saka-dev"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-94"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "n/a", "source": "cna", "vendor": "n/a"}, "product": "saka-dev", "vendor": "sakadev"}], "analysis": {"en": {"generated_at": "2026-04-08T18:23:25.352984+00:00", "value": {"mitigation_remediation": ["Update the SakaDev extension to the latest patched version as soon as it becomes available.", "Disable automatic command execution or enforce user confirmation for all commands in the extension\u2019s settings.", "Monitor the extension\u2019s activity for unexpected command executions.", "Limit the extension\u2019s permissions to run only the commands that are strictly necessary.", "Keep Visual Studio Code and its extensions regularly updated."], "summary": {"action": "Immediate Patch", "impact": "Arbitrary Command Execution"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the SakaDev extension for Visual Studio Code developed by Rahman Azhar. No specific product versions are listed as fixed, and the published data do not identify which releases are vulnerable, so the impact scope encompasses all installed copies of the extension until a patch becomes available.", "description_and_impact": "SakaDev is a Visual Studio Code extension that automatically runs terminal commands suggested by a language model. The extension classifies commands as safe or potentially destructive, executing safe ones without user confirmation. The design permits prompt injection, allowing an attacker to embed malicious code within a seemingly harmless prompt that misleads the model into labeling the command safe, thereby bypassing the safety check and executing arbitrary shell commands.", "risk_and_exploitability": "The CVSS score of 9.8 indicates critical severity. The EPSS score of less than 1% suggests that no widespread exploitation has been observed to date, but the high severity means an attacker who can influence the model\u2019s prompt could trigger execution of arbitrary commands. The vulnerability is not listed in the CISA KEV catalog. Attack likely occurs from within the extension\u2019s user interface where the model processes prompts, making it essential to mitigate the issue."}}}}, "created": "2026-03-31T20:00:22.186839+00:00", "title": "Prompt Injection Causing Arbitrary Command Execution in SakaDev Visual Studio Code Extension", "updated": "2026-04-08T20:00:49.177900+00:00", "vendors": ["sakadev", "sakadev$PRODUCT$saka-dev"]}