Affected: aliasrobotics cai

Cybersecurity AI (CAI) is an open-source framework for building and deploying AI-powered offensive and defensive automation. Versions 0.5.9 and below are vulnerable to Command Injection through the run_ssh_command_with_credentials() function, which is available to AI agents. Only password and command inputs are escaped in run_ssh_command_with_credentials to prevent shell injection; while username, host and port values are injectable. This issue does not have a fix at the time of publication.

Affected: PyPI: cai-framework

### Summary

A command injection vulnerability is present in the function tool `run_ssh_command_with_credentials()` available to AI agents.

### Details

This is the source code of the function tool `run_ssh_command_with_credentials()` ([code](https://github.com/aliasrobotics/cai/blob/0.5.9/src/cai/tools/command_and_control/sshpass.py#L20)):

```python @function_tool def run_ssh_command_with_credentials( host: str, username: str, password: str, command: str, port: int = 22) -> str: """ Execute a command on a remote host via SSH using password authentication.

Args: host: Remote host address username: SSH username password: SSH password command: Command to execute on remote host port: SSH port (default: 22)

Returns: str: Output from the remote command execution """ # Escape special characters in password and command to prevent shell injection escaped_password = password.replace("'", "'\\''") escaped_command = command.replace("'", "'\\''") ssh_command = ( f"sshpass -p '{escaped_password}' " f"ssh -o StrictHostKeyChecking=no " f"{username}@{host} -p {port} " f"'{escaped_command}'" ) return run_command(ssh_command)

```

Note how only *password* and *command* inputs are escaped to prevent shell injection; while *username*, *host* and *port* values are left injectable.

### PoC

Create an `index.html` file with t…