CVE-2026-30308

{"dataType": "CVE_RECORD", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2026-30308", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2026-04-01T18:00:06.982Z", "dateReserved": "2026-03-04T00:00:00.000Z", "datePublished": "2026-03-30T00:00:00.000Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-03-30T20:40:44.039Z"}, "descriptions": [{"lang": "en", "value": "In its design for automatic terminal command execution, HAI Build Code Generator offers two options: Execute safe commands and Execute all commands. The description for the former states that commands determined by the model to be safe will be automatically executed, whereas if the model judges a command to be potentially destructive, it still requires user approval. However, this design is highly susceptible to prompt injection attacks. An attacker can employ a generic template to wrap any malicious command and mislead the model into misclassifying it as a 'safe' command, thereby bypassing the user approval requirement and resulting in arbitrary command execution."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://github.com/presidio-oss/hai-build"}, {"url": "https://github.com/Secsys-FDU/LLM-Tool-Calling-CVEs/issues/10"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-94", "lang": "en", "description": "CWE-94 Improper Control of Generation of Code ('Code Injection')"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-04-01T17:59:13.586823Z", "id": "CVE-2026-30308", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-01T18:00:06.982Z"}}]}, "dataVersion": "5.2"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-30308", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-04-01T17:59:13.586823Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "CWE-94 Improper Control of Generation of Code ('Code Injection')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-01T17:59:52.782Z"}}], "cna": {"affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "references": [{"url": "https://github.com/presidio-oss/hai-build"}, {"url": "https://github.com/Secsys-FDU/LLM-Tool-Calling-CVEs/issues/10"}], "descriptions": [{"lang": "en", "value": "In its design for automatic terminal command execution, HAI Build Code Generator offers two options: Execute safe commands and Execute all commands. The description for the former states that commands determined by the model to be safe will be automatically executed, whereas if the model judges a command to be potentially destructive, it still requires user approval. However, this design is highly susceptible to prompt injection attacks. An attacker can employ a generic template to wrap any malicious command and mislead the model into misclassifying it as a 'safe' command, thereby bypassing the user approval requirement and resulting in arbitrary command execution."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "n/a"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-03-30T20:40:44.039Z"}}}, "cveMetadata": {"cveId": "CVE-2026-30308", "state": "PUBLISHED", "dateUpdated": "2026-04-01T18:00:06.982Z", "dateReserved": "2026-03-04T00:00:00.000Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2026-03-30T00:00:00.000Z", "assignerShortName": "mitre"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "source": "cve@mitre.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:presidio:hai_build:*:*:*:*:*:*:*:*", "matchCriteriaId": "587BA5B8-B05F-460B-8127-EBB6C8AEE87D", "versionEndIncluding": "3.13.3", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In its design for automatic terminal command execution, HAI Build Code Generator offers two options: Execute safe commands and Execute all commands. The description for the former states that commands determined by the model to be safe will be automatically executed, whereas if the model judges a command to be potentially destructive, it still requires user approval. However, this design is highly susceptible to prompt injection attacks. An attacker can employ a generic template to wrap any malicious command and mislead the model into misclassifying it as a 'safe' command, thereby bypassing the user approval requirement and resulting in arbitrary command execution."}, {"lang": "es", "value": "En su dise\u00f1o para la ejecuci\u00f3n autom\u00e1tica de comandos de terminal, HAI Build Code Generator ofrece dos opciones: Ejecutar comandos seguros y Ejecutar todos los comandos. La descripci\u00f3n de la primera opci\u00f3n establece que los comandos determinados por el modelo como seguros se ejecutar\u00e1n autom\u00e1ticamente, mientras que si el modelo juzga que un comando es potencialmente destructivo, a\u00fan requiere la aprobaci\u00f3n del usuario. Sin embargo, este dise\u00f1o es altamente susceptible a ataques de *prompt injection*. Un atacante puede emplear una plantilla gen\u00e9rica para envolver cualquier comando malicioso y enga\u00f1ar al modelo para que lo clasifique err\u00f3neamente como un comando 'seguro', eludiendo as\u00ed el requisito de aprobaci\u00f3n del usuario y resultando en la ejecuci\u00f3n arbitraria de comandos."}], "id": "CVE-2026-30308", "lastModified": "2026-06-17T10:32:37.850", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-30308", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-04-01T17:59:13.586823Z", "version": "2.0.3"}}]}, "published": "2026-03-30T21:17:09.107", "references": [{"source": "cve@mitre.org", "tags": ["Third Party Advisory"], "url": "https://github.com/Secsys-FDU/LLM-Tool-Calling-CVEs/issues/10"}, {"source": "cve@mitre.org", "tags": ["Product"], "url": "https://github.com/presidio-oss/hai-build"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-94"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "n/a", "source": "cna", "vendor": "n/a"}, "product": "hai_build", "vendor": "presidio-oss"}], "analysis": {"en": {"generated_at": "2026-04-08T17:26:45.961762+00:00", "value": {"mitigation_remediation": ["Disable the \u2018Execute all commands\u2019 mode and rely solely on the safe\u2011command option whenever possible.", "Restrict use of the generator to trusted authorized users and enforce least\u2011privilege access controls.", "Run the tool inside a sandbox or isolated environment to contain any potential damage.", "Implement logging and monitoring of all executed commands to detect anomalous activity.", "Follow Presidio\u2019s repository or contact the maintainer for a patch, and apply it as soon as it becomes available."], "summary": {"action": "Apply Fix", "impact": "Arbitrary Command Execution"}, "threat_synthesis": {"affected_systems": "The affected product is Presidio\u2019s HAI Build Code Generator. All releases incorporating the automatic command\u2011execution feature are potentially vulnerable, as no specific version data is provided. Users of the tool should assume all current installations are at risk until a fix is applied.", "description_and_impact": "The vulnerability arises from a prompt injection flaw in the HAI Build Code Generator that causes the language model to incorrectly flag malicious shell instructions as \"safe\". Attackers can craft prompts that deceive the model into believing a destructive command is harmless, triggering automatic execution without user consent. This weakness is identified as CWE-94, an instance of code injection that permits arbitrary code execution on the host system.", "risk_and_exploitability": "The CVSS base score of 9.8 marks the flaw as critical, yet the EPSS score of less than 1% indicates that exploitation events are currently rare. The vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed widespread exploitation to date. The likely attack vector, inferred from the description, is a prompt injection via the code\u2011generation interface, where a crafted user input leads the model to invoke unintended terminal commands."}}}}, "created": "2026-03-31T20:00:21.201156+00:00", "updated": "2026-04-08T20:00:48.103844+00:00", "vendors": ["presidio-oss", "presidio-oss$PRODUCT$hai_build"]}