HexStrike AI contains a critical OS command injection vulnerability in its API endpoints that allows unauthenticated remote attackers to execute arbitrary system commands.

The application fails to sanitize user-supplied input across over 90 tool execution endpoints, concatenating parameters directly into shell commands executed via subprocess.Popen with shell=True. This allows an unauthenticated attacker to inject malicious shell metacharacters to gain full system access.

Successful exploitation grants an attacker the ability to execute arbitrary commands on the host server with the privileges of the application process. Given the CVSS score of 7.3, this represents a high-risk scenario that can lead to complete server compromise, lateral movement within the network, and the exfiltration of sensitive data or credentials.

Immediate Action: Since a patch is currently in progress, administrators should immediately restrict access to the HexStrike AI API endpoints using network-level controls or a firewall to ensure they are not exposed to the public internet.

Proactive Monitoring: Monitor server logs for suspicious POST requests to the /api/tools/* path containing shell metacharacters such as semicolons, pipes, or backticks.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block requests containing shell injection patterns targeting the API tool endpoints.

Public Exploit Available: Yes, a published proof-of-concept exists as detailed in the GitHub issue tracker for the project.

The severity of this vulnerability cannot be overstated, as it provides an unauthenticated attacker with a direct path to remote code execution. Because the software lacks versioning and a definitive patch is currently pending, it is imperative to isolate the affected service from all untrusted networks immediately to prevent unauthorized access.