Code Injection Vulnerability in DeepTutor 1.4.0 by HKUDS
CVE-2026-51881

Currently unrated

Key Information:

Vendor

HKUDS

Status
DeepTutor
Vendor
CVE Published:
1 October 2026

What is CVE-2026-51881?

DeepTutor version 1.4.0 is vulnerable to a code injection attack, where a malicious actor can exploit the WebSocket interface to run arbitrary shell commands within the service's environment. By interacting with the ExecTool.execute component, attackers can manipulate the application to execute harmful commands, jeopardizing the security and integrity of the system. This vulnerability underscores the importance of proper input validation and security measures to prevent unauthorized command execution.

References

https://github.com/HKUDS/DeepTutor/issues/518
https://gist.github.com/Ro1ME/77331f8ae45f617d33f7100c3f4...

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.