The GH05TCREW PentestAgent is vulnerable to remote command injection, allowing an attacker to execute arbitrary code on the host machine with the privileges of the operator.

The application utilizes the LocalRuntime component to execute shell commands via asyncio.create_subprocess_shell without any validation, sandboxing, or filesystem isolation. An unauthenticated remote attacker can trigger this vulnerability by injecting malicious instructions into target system outputs (such as HTTP responses), which are then processed by the LLM and executed directly on the host system.

Successful exploitation leads to full remote code execution on the machine running the PentestAgent. This grants an attacker the ability to access local credentials, modify sensitive system files, establish persistence, or move laterally within the internal network. Given the CVSS score of 7.3, this represents a high-severity risk that could lead to complete system compromise and significant data loss.

Immediate Action: Switch from the default LocalRuntime to the DockerRuntime by using the --docker flag, which provides containerized isolation for command execution.

Proactive Monitoring: Review system logs for unusual shell command executions, specifically monitoring for commands involving network utilities like curl, wget, or nc, and modifications to sensitive directories like ~/.ssh or ~/.bashrc.

Compensating Controls: If usage of the local runtime is strictly required, ensure the agent is executed within a restricted environment using security tools such as AppArmor or seccomp profiles to limit filesystem and network access.

Public Exploit Available: Yes, a published proof-of-concept exists in the researcher's write-up provided in the official GitHub issue tracker.

Users must immediately transition to the DockerRuntime to mitigate the risk of host-level compromise. Since a permanent patch in the form of updated code is currently pending, operational changes to the execution environment are the only effective method to prevent unauthorized command execution until the vendor releases a hardened version of the LocalRuntime.