Executive brief
Ridvay Code, an AI-driven design and automation tool, contains a critical security flaw in its command auto-approval system. This system is designed to automatically permit safe operations while blocking dangerous ones, but it can be tricked into running malicious code hidden inside seemingly harmless commands. An attacker could exploit this to take full control of the server, potentially leading to the theft of customer data or a complete service shutdown.
Technical details
An OS command injection vulnerability exists in Ridvay Code's command auto-approval module due to improper neutralization of special elements in the Tool Call Parser. The system uses fragile regular expressions to validate commands against a whitelist but fails to account for shell command substitution syntax, such as $(...) and backticks. By embedding malicious payloads within arguments of an approved command (e.g., git log), an attacker can bypass the validation logic. The underlying shell executes the substituted command with the privileges of the application, leading to Remote Code Execution (RCE) without requiring user interaction. The vulnerability affects versions up to and including 0.1.1.
Affected products
- Ridvay Code Auto-approval module <= 0.1.1
Timeline
- 2026-03-27: disclosed: Vulnerability reported on GitHub by Secsys-FDU
- 2026-03-31: advisory: CVE-2026-30311 published by NVD/MITRE