DeepTutor: Remote command execution via TutorBot shell tool
Summary
DeepTutor v1.4.0 allows command execution through the TutorBot shell tool (ExecTool.execute in shell.py). A user prompt sent over the TutorBot WebSocket interface can cause the LLM to select the shell tool, which passes a generated command to the host shell. An attacker who can reach the interface may run arbitrary commands on the server with the privileges of the DeepTutor service, under the condition that the shell tool is enabled for the bot.
Affected
- DeepTutor v1.4.0 (per CVE description)
- Component: deeptutor/tutorbot/agent/tools/shell.py (ExecTool.execute)
- Earlier versions: Unknown.
- Exact affected range: Unknown; not confirmed from vendor sources.
Fixed in
- Unknown. No vendor advisory for this CVE ID was found.
- The vendor's release notes for v1.4.1 mention ExecTool hardening (GitHub issue #506), but this has not been confirmed as the fix for CVE-2026-51870.
Workaround
- Unknown. No vendor-published workaround found.
- Disable the ExecTool / shell execution capability for TutorBots.
- Restrict network access to the DeepTutor service and the TutorBot WebSocket interface.
Exploitation
- CISA SSVC: exploitation status poc, automatable yes, technical impact total.
- Known exploited (KEV): No, according to Strix.
- Public proof of concept: Unknown. A gist with reproduction notes is referenced; its content was not reviewed.
- EPSS: about 0.9% in one source.
Our recommendation
- Inventory all DeepTutor instances and their versions, especially v1.4.0 and earlier.
- Check whether the TutorBot WebSocket interface is reachable from outside and remove public exposure.
- Disable shell execution for TutorBots unless strictly required.
- Upgrade to the latest release after confirming it fixes this issue, then re-check exposure.
- Monitor logs of the TutorBot WebSocket and unexpected processes spawned by the DeepTutor service.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE-2026-51870 gist (Ro1ME) gist.github.com
- DeepTutor GitHub issue #506 github.com
- Vulners VulnRichment CVE-2026-51870 vulners.com
- Strix CVE-2026-51870 www.strix.ai
- OffSeq Radar CVE-2026-51870 radar.offseq.com
- Snyk PyPI vulnerabilities security.snyk.io
- DeepTutor GitHub repository github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 21:44.
Original description (NVD)
DeepTutor v1.4.0 is vulnerable to command execution in /tutorbot/agent/tools/shell.py:ExecTool.execute.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.