Executive brief
Pensar Apex, an autonomous AI agent used for web scanning and automation, contains a security flaw that allows for remote command execution. By tricking the AI agent into visiting a malicious website or processing specific input, an attacker can execute arbitrary operating system commands on the host machine. This could lead to full system takeover, theft of sensitive credentials like SSH keys or API tokens, and unauthorized access to the local network.
Technical details
An OS command injection vulnerability exists in @pensar/apex <= 0.0.58 within the createSmartEnumerateTool() function in src/core/agent/tools.ts. The application constructs a shell command by concatenating unsanitized input from the 'extensions' array and 'url' parameter directly into a string passed to Node.js child_process.exec(). Because exec() spawns a shell, an attacker can use shell metacharacters (e.g., semicolons or ampersands) to break out of the intended command and execute arbitrary code. This can be triggered via direct tool invocation or through prompt injection if the LLM agent processes a malicious web page. The vendor has reportedly declined to patch, stating this is intended functionality.
Affected products
- Pensar AI apex <= 0.0.58
Timeline
- 2026-02-17: disclosed: Vendor notified; CTO declined to patch stating it is intended functionality.
- 2026-04-13: advisory: Public disclosure of the vulnerability.
- 2026-05-27: other: CVE published to NVD.