Executive brief
AutoForge (formerly autocoder) is an AI-powered development tool used to automate coding tasks. A security vulnerability in its development server component allows an attacker to remotely execute arbitrary commands on the host system. This could lead to a complete takeover of the server, theft of source code, or unauthorized access to the development environment.
Technical details
A command injection vulnerability (CWE-77) exists in the AutoForge (formerly autocoder) development server API. The vulnerability is located in the POST /api/projects/{project}/devserver/start and PATCH /api/projects/{project}/devserver/config endpoints. By providing a specially crafted command parameter, a remote attacker with network access to the API can bypass neutralization and execute arbitrary OS commands. This occurs because the application fails to properly sanitize user-supplied input before using it in a system command context. The vulnerability was identified in commit 79d02a1410ef2d2c64f84e883be10a9a7105e744.
Affected products
- leonvanzyl AutoForge (formerly autocoder) commit 79d02a1410ef2d2c64f84e883be10a9a7105e744
Timeline
- 2026-04-27: advisory: NVD publication date