CVE-2026-123675High· 8.3▾ MidnightPoC availableA flaw has been found in OpenBMB Internet of Agents up to 9d78e88e47160eb42ee1ee8538c05e1c2c47877a. This affects the function execute_code of the file im_client/agents/tools/code_executor.py of the component Code Executor Tool. This mani…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 45.7 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Exploit / PoC code exists
0.5%
A flaw has been found in OpenBMB Internet of Agents up to 9d78e88e47160eb42ee1ee8538c05e1c2c47877a. This affects the function execute_code of the file im_client/agents/tools/code_executor.py of the component Code Executor Tool. This manipulation of the argument filename/lang causes code injection. The attack can be initiated remotely. The exploit has been published and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.
internet_of_agents 9d78e88e47160eb42ee1ee8538c05e1c2c47877aRefer to the linked advisories for vendor-supplied fixes and affected version ranges.
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-123963High· 7.3OpenBMB Internet of Agents Agent Registry app.py register missing authentication
CVE-2026-123964Medium· 4.3OpenBMB Internet of Agents Collaboration Layer communication_layer.py launch_goal infinite loop
CVE-2026-123881High· 7.3OpenBMB Internet of Agents Message app.py fetch_chat_record access control
CVE-2026-123791High· 7.3OpenBMB Internet of Agents Agent Registry milvus_utils.py _primary_field_query data query logic injection
CVE-2026-123032High· 7.3OpenBMB Internet of Agents WebSocket Connection Manager app.py ConnectionManager.connect missing authentication
CVE-2025-10097Medium· 6.3A vulnerability was identified in SimStudioAI sim up to 1.0.0