CVE-2026-51857

CodeExecutionToolkit runs model‑generated Python via SubprocessInterpreter without approval.

• CWE-94 (inferred)
• Input Validation and Sanitization
• Remote

In camel-ai camel 0.2.91a1, v0.2.91a2 and v0.2.91a3, CodeExecutionToolkit can run model-produced Python code through SubprocessInterpreter without an approval boundary.

CVE

CVE-2026-51857

CWE

CWE-94 (inferred)

Published

2026-09-30

OWASP

A03 Injection

Orthogonal defect classification

Checking

Code defect classification

Missing Check

Category

Input Validation and Sanitization

Subcategory

Command Injection

Accessibility scope

Remote

Impact

Arbitrary Code Execution

Affected component

camel-ai

Fixed by upgrading

Yes

Solution

Upgrade to camel‑ai camel ≥ 0.2.92, which removes the unapproved SubprocessInterpreter execution.

from camel_ai.toolkits import CodeExecutionToolkit
from camel_ai.interpreters import SubprocessInterpreter

class MyToolkit(CodeExecutionToolkit):
    def run_model_code(self, code: str):
        # VULNERABLE: executes arbitrary model-generated code without approval
        interpreter = SubprocessInterpreter()
        return interpreter.execute(code)

from camel_ai.toolkits import CodeExecutionToolkit
from camel_ai.interpreters import SubprocessInterpreter

class MyToolkit(CodeExecutionToolkit):
    def run_model_code(self, code: str):
        # FIX: requires explicit approval before execution
        if not code.strip().startswith("APPROVED:"):
            raise ValueError("Code execution not approved")
        interpreter = SubprocessInterpreter()
        return interpreter.execute(code)

__VAITP_MODEL_REFUSED__

@misc{vaitp:cve202651857,
  title        = {{CodeExecutionToolkit runs model‑generated Python via SubprocessInterpreter without approval.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2026},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2026-51857},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2026-51857/}}
}