CVE-2026-91140

9.6 CRITICALpublic exploit available

Published 2026-10-06 · Updated 2026-10-07

AI risk analysis

Summary: The flaw is an OS command injection vulnerability in the Progress Software Autonomous REST Connector GenAI Agents ARCGenAI-Generator version 2.0, allowing attackers to execute arbitrary commands on a developer's machine via a crafted Swagger/OpenAPI document.
Exploitability: Exploitation is relatively straightforward for attackers who can supply a crafted Swagger/OpenAPI document, requiring user interaction to invoke the generator.
Blast radius: If exploited, this vulnerability could lead to full compromise of the developer's machine, potentially leading to data theft, system damage, or further lateral movement within the network.
Detection: No reliable host or network indicator is derivable from the published description.
Prioritized remediation: Upgrade to Progress Software Autonomous REST Connector GenAI Agents ARCGenAI-Generator version 2.0 or later.

rcewebapios-command-injection

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

An OS command injection vulnerability in the shell-based temporary-file cleanup instructions in Progress Software Autonomous REST Connector GenAI Agents ARCGenAI-Generator version 2.0 allows an attacker who supplies a crafted Swagger/OpenAPI document to execute arbitrary commands on a developer's machine when a user invokes the generator.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Weaknesses

CWE-78

Public exploit & PoC references

https://github.com/progress/datadirect-arc-ai-model-gen/commit/7ede6d96eb033d647ffdcabf8d8069c098293575

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

Related by shared AI tags and CWE weakness class. Browse the full archive.