Progress ARCGenAI-Generator: OS command injection via crafted Swagger/OpenAPI file
Summary
The ARCGenAI-Generator GenAI agent definitions of Progress Software Autonomous REST Connector, version 2.0, contain an OS command injection flaw in their shell-based temporary-file cleanup instructions. An attacker who supplies a crafted Swagger/OpenAPI document can execute arbitrary commands on a developer's machine when a user runs the generator. Exploitation requires that the user processes the malicious document, and CISA SSVC lists exploitation as none.
Affected
- Progress Software Autonomous REST Connector GenAI Agents (ARCGenAI-Generator) 2.0 to before 2.1
- Per the vendor bulletin reports: ARCGenAI-Generator.agent.md v2.0, ARCGenAI-Generator.prompt.md v1.0, ARCGenAI-EntityGen.agent.md v1.0 (version scope to be verified with Progress)
Fixed in
- Upgrade ARCGenAI-Generator to version 2.1 or later (agent definitions from the official repository)
- Fix commit: 7ede6d96eb033d647ffdcabf8d8069c098293575
Workaround
- Until the upgrade is applied, do not process untrusted Swagger/OpenAPI documents
- Review CI/CD jobs that run the generator automatically on incoming specs
- Run agents only in isolated, least-privilege environments and rotate secrets they could access
Exploitation
- Progress has not reported active exploitation
- CISA SSVC: exploitation none, automatable no
- Not listed in CISA KEV
- EPSS: 0.01924
- Public proof of concept: Unknown
Our recommendation
- Identify any use of ARCGenAI in your environments, especially version 2.0
- Update the agent definitions to version 2.1 or later from the official repository and check all affected files
- Stop processing untrusted or third-party API specifications until the update is applied
- Review developer workstations and CI runners for unexpected files or signs of command execution
- Verify the advisory and version scope directly with Progress before closing the item
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Progress Security Alert Bulletin (CVE-2026-91140) community.progress.com
- Fix commit 7ede6d9 (GitHub) github.com
- v2.1 release (GitHub) github.com
- CVE record mirror (Vulners) vulners.com
- Vulnrichment data (OpenCVE) app.opencve.io
- Cybersecurity News coverage cybersecuritynews.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 23:24.
Original description (NVD)
An OS command injection vulnerability in the shell-based temporary-file cleanup instructions in Progress Software Autonomous REST Connector GenAI Agents ARCGenAI-Generator version 2.0 allows an attacker who supplies a crafted Swagger/OpenAPI document to execute arbitrary commands on a developer's machine when a user invokes the generator.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.