Executive brief
OpenFang is a framework for AI-driven agent automation that allows models to execute shell commands. An attacker can craft prompts that force the shell_exec function to produce unbounded output, exhausting process memory and crashing the service, rendering it unavailable to legitimate users.
Technical details
The vulnerability is an uncontrolled resource allocation flaw in the shell_exec tool handler within OpenFang's runtime. The issue stems from the absence of upper bounds on the timeout_seconds parameter and the fact that cmd.output() buffers all stdout/stderr data into process memory before truncation occurs. An attacker with access to send prompts to a shell-enabled agent (authenticated API access required) can specify an extremely large timeout and trigger a command that produces unbounded output (e.g., yes OPENFANG_SHELL_OUTPUT_DOS), causing memory exhaustion and out-of-memory termination. The vulnerable code is in crates/openfang-runtime/src/tool_runner.rs. A public exploit has been released; reproduction has been confirmed in Docker deployments where the affected container is OOM-killed within seconds.
Affected products
- RightNow-AI OpenFang up to 0.6.9
Timeline
- 2026-09-03: disclosed