CAMEL CodeExecutionToolkit: Code execution without approval boundary
Summary
CVE-2026-51857 affects camel-ai versions 0.2.91a1 to 0.2.91a3. The CodeExecutionToolkit passes model-produced Python code to SubprocessInterpreter, which runs it in a local subprocess without an explicit confirmation or policy gate. An attacker who can influence the model's input, for example through content the agent processes, can cause arbitrary Python code to run with the privileges of the host process. The CVSS score of 9.8 is critical, and CISA SSVC rates exploitation as PoC and automatable.
Affected
- camel-ai 0.2.91a1
- camel-ai 0.2.91a2
- camel-ai 0.2.91a3
- Relevant when CodeExecutionToolkit is used with sandbox="subprocess"
Fixed in
Unknown.
Workaround
- Keep human confirmation enabled for code execution and do not expose the toolkit to untrusted input
- Do not use sandbox="subprocess" on production hosts
- Run the agent in a container or VM with restricted file system and network access
- Limit the operating system permissions of the account running the agent
Exploitation
- Proof of concept: the public issue #4037 describes a reproduction in which a normal user prompt causes execute_code to run code on the host
- CISA SSVC: Exploitation poc, Automatable yes, Technical Impact total
- Exploitation in the wild: Unknown.
Our recommendation
- Inventory all camel-ai installations and check for versions 0.2.91a1 to 0.2.91a3
- Disable CodeExecutionToolkit or the subprocess sandbox until a fixed version is confirmed
- Upgrade to a fixed release as soon as the vendor publishes one and verify the version afterwards
- Restrict network access and monitor the host for unexpected processes or file creation
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE-2026-51857 gist (Ro1ME) gist.github.com
- camel-ai/camel issue #4037 github.com
- VulDB CVE-2026-51857 vuldb.com
- SubprocessInterpreter documentation docs.camel-ai.org
- camel-ai/camel issue #4350 github.com
- CVE Brief archive 2026/10/04 cvebrief.com
- TheHackerWire CVE-2026-51857 www.thehackerwire.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 21:45.
Original description (NVD)
In camel-ai camel 0.2.91a1, v0.2.91a2 and v0.2.91a3, CodeExecutionToolkit can run model-produced Python code through SubprocessInterpreter without an approval boundary.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.