Executive brief
HackingBuddyGPT is an open-source tool that uses AI to automate pentesting by connecting to target machines via SSH. A vulnerability allows attackers on a compromised target to inject malicious instructions into command output, which the tool then feeds to an LLM that generates shell commands. These commands are executed on the operator's local workstation rather than the target, giving attackers access to the pentester's SSH keys, credentials, and internal network resources.
Technical details
The vulnerability is a prompt-injection-enabled command injection flaw in the ssh_run_command function and surrounding workflow. Raw SSH command output from the target machine is captured without sanitization and appended directly to the LLM conversation history. An attacker controlling the target (or its output via /etc/motd, shell aliases, or file contents) can embed instructions that influence the LLM to generate arbitrary shell commands. These generated commands bypass input validation and are executed on the operator's local machine via tmux send-keys in the operator's user context—not sandboxed. Successful exploitation results in remote code execution on the pentester's workstation with full access to their credentials and internal network. The exploit is publicly available and the vendor has not responded to disclosure.
Affected products
- ipa-lab HackingBuddyGPT up to 0.5.0
Timeline
- 2026-08-04: disclosed: Vulnerability reported via GitHub issue #150
- 2026-09-14: advisory: CVE-2026-90621 published on NVD