CVE-2026-105135: InternLM MindSearch Planner Agent graph.py ExecutionAction.run code injection

Severity: critical (CVSS 10.0 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-04 · updated 2026-10-06
Weakness: CWE-74

Description

A vulnerability has been found in InternLM MindSearch 0.1.0. This issue affects the function ExecutionAction.run of the file mindsearch/agent/graph.py of the component Planner Agent. The manipulation of the argument inputs leads to code injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products

InternLM MindSearch: 0.1.0

References

https://gist.github.com/DReazer/7ad46df9da73d0cf414276e4195b2183
https://vuldb.com/cve/CVE-2026-105135
https://vuldb.com/submit/943315
https://vuldb.com/vuln/413352
https://vuldb.com/vuln/413352/cti

Get alerted when CVE-2026-105135 or the next vulnerability affects your stack