Executive brief
GPT-Pilot is an AI-driven development tool that automates the creation of software projects. A security flaw in how it handles user-provided commands allows an attacker to execute unauthorized code on the host system. This could lead to a full system compromise or unauthorized access to sensitive development data, as the tool runs with the same permissions as the user.
Technical details
A command injection vulnerability (CWE-78) exists in GPT-Pilot versions up to 0.0.10 within the Executor.run() method. The vulnerability occurs during project execution when the system prompts a user to confirm or modify a command; the application accepts free-text input and passes it directly to asyncio.create_subprocess_shell() without sufficient validation or sanitization. An attacker can exploit this by supplying malicious shell commands, resulting in arbitrary code execution with the privileges of the GPT-Pilot process. As of the advisory date, no patched version has been identified.
Affected products
- Pythagora-io gpt-pilot <= 0.0.10
Timeline
- 2025-09-03: other: Vulnerability identified in commit 0819827ce20346ef5f25b3fe29293cb448840565
- 2026-05-11: disclosed
- 2026-05-11: advisory