What’s Vulnerable › Vulnerabilities

CVE-2026-30309

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-03-31 · updated 2026-07-25
• Weakness: CWE-78

Description

InfCode's terminal auto-execution module contains a critical command filtering vulnerability that renders its blacklist security mechanism completely ineffective. The predefined blocklist fails to cover native high-risk commands in Windows PowerShell (such as powershell), and the matching algorithm lacks dynamic semantic parsing unable to recognize string concatenation, variable assignment, or double-quote interpolation in Shell syntax. Malicious commands can bypass interception through simple syntax obfuscation. An attacker can construct a file containing malicious instructions for remote code injection. When a user imports and views such a file in the IDE, the Agent executes dangerous PowerShell commands outside the blacklist without user confirmation, resulting in arbitrary command execution or sensitive data leakage.

Affected products

• Tokfinity Infcode: through 1.3.1

References

• https://github.com/Secsys-FDU/LLM-Tool-Calling-CVEs/issues/11
• https://www.tokfinity.com/infcode

Get alerted when CVE-2026-30309 or the next vulnerability affects your stack