A critical arbitrary file upload vulnerability in Cohere North AI version 1.1.5 enables unauthenticated remote code execution, posing a severe risk to system integrity.

The application fails to properly validate file uploads within the /v1/my_drive/batch_upload endpoint, allowing an unauthenticated attacker to upload and execute arbitrary code on the underlying server.

The ability for an unauthenticated user to execute arbitrary code represents a total compromise of the affected system, as indicated by the CVSS score of 9.8. This vulnerability could lead to complete loss of data confidentiality, integrity, and availability, potentially resulting in unauthorized access to sensitive corporate data and long term reputational damage.

Immediate Action: Since a specific patch is not currently identified, immediately restrict access to the /v1/my_drive/batch_upload endpoint at the network or application level.

Proactive Monitoring: Review web server access logs for anomalous POST requests to the batch_upload endpoint, particularly those originating from untrusted IP addresses or containing suspicious file extensions.

Compensating Controls: Deploy Web Application Firewall (WAF) rules designed to inspect file uploads and block non-permitted file types or requests directed at the vulnerable component.

Public Exploit Available: Yes, a published proof-of-concept exists (referenced in the researcher write-up at github.com/bdadoa/Cohere---North-AI-1.1.5---Vulnerabilities).

Given the critical CVSS severity and the availability of a public proof-of-concept, this vulnerability must be treated as a high priority. Organizations should prioritize isolating the affected component until the vendor provides a formal security update, as unauthenticated remote code execution vulnerabilities are prime targets for automated exploitation.