CVE-2026-30304 - Vulnerability Analysis

Overview

AI Code contains a command injection vulnerability caused by prompt injection allowing attackers to bypass user approval and execute arbitrary terminal commands automatically.

Severity & Score

Impact

Attackers can execute arbitrary terminal commands automatically, potentially compromising the entire system.

Mitigation

Update to the latest version with improved command classification and user approval mechanisms.

References

• https://github.com/Secsys-FDU/LLM-Tool-Calling-CVEs/issues/2
• https://marketplace.visualstudio.com/items?itemName=tianguaduizhang.claude-dev-china

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 27, 2026

🔴 CVE-2026-30304 - Critical (9.6) In its design for automatic terminal command execution, AI Code offers two options: Execute safe commands and execute all commands. The description for the former states that commands determined by the model to be safe will be automatically execut... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-30304/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner