CVE-2026-5584 is a high severity (CVSS 7.3) code injection flaw in Fosowl agenticSeek 0.1.0. The record places it in the PyInterpreter.execute function behind the query endpoint and lists no fix. The vendor did not respond to the disclosure. Keep the endpoint off untrusted networks.
What's affected
The record lists agenticSeek version 0.1.0 from Fosowl. The affected code is the execute function in sources/tools/PyInterpreter.py, reached through the query endpoint.
The record does not say whether later versions are affected, and it names no fixed version. It says the vendor was contacted early and did not respond. The public reference is a GitHub issue that carries only the CVE number, so it adds no detail. Check the project's repository for newer releases before relying on any version.
How to check if you're exposed
agenticSeek is a self hosted AI agent project, so check how you run it.
- Look at the version in your checkout or container image. If it is 0.1.0, treat it as affected.
- Find out whether the query endpoint is reachable from outside the machine. Check the port binding, reverse proxy and firewall rules.
- Review any logs for requests to the query endpoint from sources you do not recognize.
Run the free in-browser dependency scan at https://gold.safeguard.sh/scan against your manifest or lockfile. It lists vulnerable packages without installing anything.
What to do now
- Bind the service to localhost or a private network, and put authentication in front of it if it must be shared.
- Run it in a container or virtual machine with no access to credentials, source code or production networks.
- Check the project repository for a release newer than 0.1.0 and read its notes for this issue.
- If you cannot confirm a fix, remove the service from any environment that holds sensitive data.
- Rotate any keys the host could reach if you suspect the endpoint was exposed.
Why it matters
The record lists CWE-94, improper control of generated code, and CWE-74, injection. An endpoint takes input that ends up in a function meant to run Python, and the input is not constrained to what the operator intended.
For AI agent tools, running code is often the feature itself. That makes the surrounding controls decide the outcome: who can send a request, and what the host can reach if the code runs. The record says a public exploit exists. The CVE is not in CISA's Known Exploited Vulnerabilities catalog.
The sensible default for any agent that executes code is a sandbox with no standing credentials and no inbound access from untrusted networks.
Quick check
Is a fixed version available?
The record names none and says the vendor did not respond. Check the project repository, and treat 0.1.0 as affected until you can confirm otherwise.
Sources
Last reviewed: 19 October 2026.
