CVE-2026-51881
Quick assessment
Affected
n/a n/a
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
DeepTutor 1.4.0 版本中存在代码注入漏洞，位于 ExecTool.execute 方法中。通过实时辅导机器人（tutorbot）WebSocket 接口，远程攻击者可以诱导服务环境中的工具层执行由审查者（reviewer）选择的 Shell 命令。
Possible ATT&CK Techniques 3 AI
T1068 · Exploitation for Privilege Escalation T1059 · Command and Scripting Interpreter T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-51881
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
deeptutor 1.4.0 contains code injection in ExecTool.execute. Through the live tutorbot WebSocket interface, a remote caller can induce the tool layer to execute reviewer-chosen shell commands in the service environment.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| - | n/a | n/a | - |
|
II. Public POCs for CVE-2026-51881
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-51881
请登录查看更多情报信息。
Proof of Concept for CVE-2026-51881 (1)
Other References for CVE-2026-51881 (1)
Same Patch Batch · n/a · 2026-10-01 · 21 CVEs total
| CVE-2026-103484 | 8.8 HIGH | pgvector buffer overflow in IVFFlat index build |
| CVE-2026-103531 | 5.5 MEDIUM | OpenSC card-setcos.c setcos_construct_fci_44 stack-based overflow |
| CVE-2026-51876 | DeepTutor 1.4.0授权绕过漏洞 | |
| CVE-2026-51875 | Devika v1.0存在路径遍历漏洞 | |
| CVE-2026-51892 | RagFlow 0.24.0 /v1/document/get/ 接口访问控制错误漏洞 | |
| CVE-2026-51896 | RagFlow 0.25.3恢复模块越权访问漏洞 | |
| CVE-2026-51882 | Langchain-Chatchat 0.3.0 文件上传路径穿越漏洞 | |
| CVE-2026-51886 | LangFlow v1.9.3代码注入漏洞 | |
| CVE-2026-51878 | DeepTutor 1.4.0 对象标识符授权绕过漏洞 | |
| CVE-2026-51873 | Devika v1.0目录遍历漏洞 | |
| CVE-2026-51879 | DeepTutor 1.4.0 认证绕过漏洞 | |
| CVE-2026-51897 | RAGFlow 0.24.0 get_dataset接口存在命令执行漏洞 | |
| CVE-2026-51884 | Langchain Chatchat 0.3.1临时文档上传路径遍历漏洞 | |
| CVE-2026-51888 | Langflow v1.8.4 目录遍历漏洞 | |
| CVE-2026-51893 | RagFlow 0.24.0 越权访问漏洞 | |
| CVE-2026-51880 | Deeptutor 1.4.0 EditFileTool路径遍历漏洞 | |
| CVE-2026-51895 | Ragflow 0.24.0及之前版本存在更新元数据不当访问控制漏洞 | |
| CVE-2026-51874 | Devika v1.0路径穿越漏洞 | |
| CVE-2026-51894 | RAGFlow 0.24.0 任意文件读取漏洞 | |
| CVE-2026-51883 | Langchain-Chatchat 0.3.x 知识库创建接口路径穿越漏洞 |
IV. Related Vulnerabilities
V. Comments for CVE-2026-51881
No comments yet