Description
deeptutor 1.4.0 contains code injection in ExecTool.execute. Through the live tutorbot WebSocket interface, a remote caller can induce the tool layer to execute reviewer-chosen shell commands in the service environment.
Critical · 9.8
CVE-2026-51881
EUVD-2026-91124GHSA-33xc-p62q-whgp
deeptutor 1.4.0 contains code injection in ExecTool.execute. Through the live tutorbot WebSocket interface, a remote caller can induce the …
Published Oct 1, 2026 · Updated Oct 5, 2026 · Assigned by mitre