Dashboard / CVE-2026-117560

CVE-2026-117560

HIGH
MEDIUM Priority: 0.06 BB Relevance: 42/100
Published: 2026-10-27 Modified: 2026-10-28 First seen: 2026-10-29 Status: active

Attack Surface

Low Complexity No Interaction Conf. Impact Integ. Impact

CVSS Vector Breakdown

AV: Local
AC: Low
PR: Low
UI: None
AT: None
VC: High
VI: High
VA: High

Description

ATXP Gemini CLI extension through 1.0.0 contains an OS command injection vulnerability in runAtxp() that allows attackers to execute shell commands through unsanitized MCP tool parameters. Attackers can plant instructions in email or SMS content to inject $() or backtick substitutions into parameters like message_id, subject, or query, running commands as the user.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
atxp gemini-cli-extension 0

References & Advisories (4)

Bug Bounty Relevance

42 / 100
✓ Low complexity
✓ No user interaction

CVSS Score

8.5 / 10.0 v4.0
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

EPSS — Exploitation Probability

0.65%
Raw Score 0.006520
Percentile 51.2%
Date 2026-10-29

EPSS Trend

2026-10-29
0.00652
2026-10-28
0.00652

Intelligence Sources

mitre ref →
nvd ref →

External Links