CVE-2025-67511 is a critical (CVSS 9.6) command injection in the Cybersecurity AI (CAI) framework version 0.5.9 and below. The SSH tool exposed to AI agents escapes some inputs but not others. The record says no fix existed at publication, so restrict the tool.
What's affected
Cybersecurity AI (CAI), published on PyPI as cai-framework, versions 0.5.9 and below. The GitHub advisory lists 0.5.9 and earlier as affected and names no patched version, which matches the record's statement that the issue had no fix at publication.
The record also links a fix commit in the repository and a third party write up. I did not verify whether a released version contains that change, so check the project's releases and advisory before assuming it is fixed.
How to check if you're exposed
See whether the package is installed and which version:
pip show cai-framework
pip freeze | grep -i cai-framework
Then check whether any agent configuration enables the SSH tool. Search your agent definitions for the function name run_ssh_command_with_credentials:
grep -rn "run_ssh_command_with_credentials" .
Also review where the agent runs and what content it reads, because the advisory's concern is that untrusted text can reach this tool.
What to do now
- Find installs of cai-framework in developer machines, notebooks and CI.
- Check the project advisory and releases for a version that contains the fix, and upgrade when one is confirmed.
- Until then, remove the SSH credential tool from agent configurations that do not need it.
- Run agents in an isolated environment with no access to production credentials or networks.
- Do not let agents read untrusted web pages or files while they have command execution tools enabled.
Why it matters
The advisory shows a classic shell injection. The tool builds a command string. Only the password and the command are escaped, while the username, host and port are placed into the string as they are. If those values come from untrusted content, they can add extra shell syntax.
What makes it modern is the route: the values can be chosen by a model that read hostile content. That makes prompt injection a delivery path for classic injection. The class is CWE-77, command injection. Treat tool arguments from an agent the same way you treat web form input: validate them and avoid building shell strings. The record does not list this CVE as known exploited.
Quick check
Is there a patched release?
The record and the advisory name none. Check the project releases and advisory page for updates before you rely on one.
Why is an AI agent tool a risk here?
A model can be steered by untrusted content, so values it passes to a tool may be attacker influenced.
Sources
Last reviewed: 18 October 2026.
