Executive brief
AgenticSeek is an open-source autonomous agent platform that allows users to run local AI without external API costs. The application exposes an unauthenticated API endpoint on port 7777 that processes user queries through an autonomous agent capable of executing shell commands. An attacker on the network can send crafted requests to this endpoint to trick the agent into executing arbitrary system commands, gaining complete control over the host system.
Technical details
The vulnerability is an unauthenticated remote code execution (RCE) flaw in the POST /query API endpoint. The root cause is that user-supplied queries are passed directly to an autonomous agent (BashInterpreter) that executes shell commands via subprocess.Popen with shell=True and safety=False, while relying on an incomplete command blocklist for protection. The attack vector is network-adjacent; attackers can send unauthenticated HTTP requests from any machine able to reach the API listening on 0.0.0.0:7777, which has wildcard CORS enabled, allowing browser-based exploitation. The vulnerable code fails to properly validate or sanitize queries before passing them to the shell executor, allowing bypass of the incomplete blocklist. An attacker achieves full host-level code execution with the privileges of the user running AgenticSeek.
Affected products
- Fosowl AgenticSeek commit fc242c7 and earlier
Timeline
- 2026-08-13: disclosed: CVE-2026-72776 published
- 2026-06-13: other: Security issue reported on GitHub (#520)