AI4Finance FinRobot: Code injection in file creation function (CVE-2026-51918)
Summary
FinRobot 1.0.0 contains a code injection flaw in CodingUtils.create_file_with_code(), which accepts file paths from LLM tool calls without validation. If an attacker can reach a FinRobot session via a web or API interface and inject prompts, they may cause files to be created outside the intended workspace, for example backdoors or web shells. Exploitation depends on the function being reachable with untrusted input in the deployment; the CVSS score of 9.8 is reported by secondary sources and is provisional while the NVD status is Deferred.
Affected
- FinRobot 1.0.0
- Other versions: Unknown.
Fixed in
Unknown. No vendor fix or patched release has been identified.
Workaround
- Do not expose FinRobot to untrusted users or networks.
- Do not pass untrusted input, including LLM output built from external content, to code-generation or file-writing functions.
- Review local changes to CodingUtils in finrobot/functional/coding.py.
- Run FinRobot in an isolated container or VM with restricted egress and a non-root account.
Exploitation
- Known exploited: No (per CISA ADP data cited by secondary sources).
- Public proof of concept: Unknown. The reporter's gist was not verified.
- In the wild: No known activity.
Our recommendation
- Check whether FinRobot 1.0.0 is installed anywhere in your environment.
- If present, isolate it from production data, customer data and credentials until a fix is available.
- Monitor GitHub issue #102 and the vendor repository for a fix and apply it promptly.
- Monitor the file system for unexpected files created outside the workspace.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub issue #102 (FinRobot) github.com
- Proof of concept gist (reporter) gist.github.com
- VulDB CVE-2026-51918 vuldb.com
- Vulners NVD record vulners.com
- OpenCVE CVE-2026-51918 app.opencve.io
- FinRobot GitHub repository github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 21:24.
Original description (NVD)
FinRobot 1.0.0 contains code injection in CodingUtils.create_file_with_code ().
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.