CAMEL TerminalToolkit: Command execution without approval in shell_exec

Summary

CAMEL (camel-ai), a Python agent framework, contains a flaw in TerminalToolkit.shell_exec. An AI agent that has this toolkit can run shell commands on the host without any approval step, so a normal user prompt is enough to trigger execution. An attacker who can influence the agent's input, for example through untrusted content such as emails, web pages or tickets, can run commands with the agent's privileges. The CVSS score is 9.8 (critical). No fixed version has been published yet.

Affected

• camel-ai CAMEL 0.2.91a1, 0.2.91a2 and 0.2.91a3 (per the CVE description)
• Only installations where TerminalToolkit is exposed to an agent are affected
• Reports on other CAMEL issues mention versions up to 0.2.91a5; this is unverified

Fixed in

Unknown.

• No vendor advisory, patched release or fix commit has been confirmed for this CVE.
• Do not assume that 0.2.91a4 or later is safe; check the vendor release notes and issue #4038.

Workaround

• Remove shell_exec / TerminalToolkit from agents that process untrusted input
• Require explicit human approval for every command
• Run the agent in a container or VM under a non-admin account without access to secrets
• Do not expose agent HTTP, MCP or OpenAPI endpoints without authentication
• Input validation and output filtering are described as options, but they are weak against prompt injection and should not be relied on alone

Exploitation

• CISA SSVC assessment: exploitation status 'poc', automatable: yes, technical impact: total
• No evidence of exploitation in the wild was found; one aggregator lists the CVE as not in CISA KEV
• The upstream issue includes a reproduction in which the agent created a file in the working directory after a normal prompt
• The CWE is listed as CWE-94 by NVD and as CWE-78 by VulDB; confirm once NVD is updated

Our recommendation

• Check whether camel-ai 0.2.91a1 to 0.2.91a3 (and later 0.2.91a* builds) is installed and whether TerminalToolkit is enabled
• Disable shell_exec for all agents until a vendor fix is confirmed
• Require human approval for shell commands and restrict the agent's file system and network access
• Monitor agent logs and the working directory for unexpected commands or files
• Watch camel-ai issue #4038 and the release notes for a fix

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• CVE-2026-51858 gist (Ro1ME) gist.github.com
• camel-ai issue #4038 github.com
• VulDB CVE-2026-51858 vuldb.com
• Strix CVE-2026-51858 www.strix.ai
• CAMEL Terminal Toolkit documentation docs.camel-ai.org
• camel-ai issue #4347 github.com
• camel-ai issue #4348 github.com
• camel-ai issue #4351 github.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 21:46.