DeepTutor: Code injection in TutorBot shell tool
Summary
DeepTutor 1.4.0 contains a code injection flaw in the shell tool (ExecTool.execute) of the TutorBot component. According to the CVSS vector, a remote caller without privileges who can reach the live TutorBot WebSocket interface can make the tool layer run attacker-chosen shell commands in the service environment. Successful exploitation can lead to full compromise of the host, depending on the privileges of the service account.
Affected
- DeepTutor 1.4.0
- Earlier versions: VulDB lists "up to 1.4.0", exact range not confirmed
Fixed in
- DeepTutor 1.4.1: the v1.4.1 release notes list issue #518 as fixed (third-party aggregator copy; vendor confirmation not found)
- DeepTutor 1.5.0 and later: the release notes list #518 as resolved and change ExecTool defaults
Workaround
- If an upgrade is not possible, disable or restrict access to the TutorBot WebSocket interface if it is not needed.
- Disable the shell or exec tool for TutorBot bots.
- Run the service under a least-privilege account with limited file system and network access. This reduces the impact but does not remove the flaw.
Exploitation
- No exploitation in the wild found in the sources; not listed in CISA KEV.
- CISA SSVC (ADP) lists exploitation as "poc" and automatable as yes.
- A public proof-of-concept write-up exists (third-party gist referenced in NVD), and the issue includes reproduction steps.
- Sources disagree: OpenCVE tags an exploit reference, while VulDB states no available exploit.
Our recommendation
- Check whether DeepTutor is in use and which version is running.
- If version 1.4.0 or earlier is used and the WebSocket is reachable from untrusted networks, treat this as urgent.
- Upgrade to 1.4.1 or later (preferably the current 1.5 line) and verify that the tool sandbox is enabled.
- Until then, disable the shell tool and restrict network access to the service.
- Review service logs for unexpected shell activity and unexpected child processes of the service.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE-2026-51881 gist (proof-of-concept write-up) gist.github.com
- HKUDS/DeepTutor issue #518 github.com
- VulDB: CVE-2026-51881 vuldb.com
- OpenCVE: CVE-2026-51881 app.opencve.io
- VulDB: vulnerability 412839 vuldb.com
- DeepTutor v1.4.1 release notes (newreleases.io) newreleases.io
- DeepTutor v1.5.0 release notes (newreleases.io) newreleases.io
- DeepTutor v1.5.0 release (GitHub) github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 21:34.
Original description (NVD)
deeptutor 1.4.0 contains code injection in ExecTool.execute. Through the live tutorbot WebSocket interface, a remote caller can induce the tool layer to execute reviewer-chosen shell commands in the service environment.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.