{"id":"CVE-2026-91140","summary":"OS command injection in Progress Software Autonomous REST Connector GenAI Agents","details":"An OS command injection vulnerability in the shell-based temporary-file cleanup instructions in Progress Software Autonomous REST Connector GenAI Agents ARCGenAI-Generator version 2.0 allows an attacker who supplies a crafted Swagger/OpenAPI document to execute arbitrary commands on a developer's machine when a user invokes the generator.","modified":"2026-10-07T02:47:29.160840613Z","published":"2026-10-06T13:46:11.357Z","database_specific":{"cna_assigner":"ProgressSoftware","cwe_ids":["CWE-78"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91140.json"},"references":[{"type":"ADVISORY","url":"https://community.progress.com/s/article/Progress-DataDirect-Critical-Security-Alert-Bulletin-September-2026-CVE-2026-91140"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91140.json"},{"type":"FIX","url":"https://github.com/progress/datadirect-arc-ai-model-gen/commit/7ede6d96eb033d647ffdcabf8d8069c098293575"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91140"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/progress/datadirect-arc-ai-model-gen","events":[{"introduced":"7b7616b507c9d9fc584a091ab2fac84f44a5c299"},{"fixed":"1067a25fcc3678605c7df09e20ee2a39c84426ac"}],"database_specific":{"source":"AFFECTED_FIELD","extracted_events":[{"introduced":"2.0"},{"fixed":"2.1"}]}}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-91140.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"}]}