{"schema":"threatline.record/2","record":{"id":"CVE-2026-91140","aliases":[],"summary":"OS command injection in Progress Software Autonomous REST Connector GenAI Agents","details":"An OS command injection vulnerability in the shell-based temporary-file cleanup instructions in Progress Software Autonomous REST Connector GenAI Agents ARCGenAI-Generator version 2.0 allows an attacker who supplies a crafted Swagger/OpenAPI document to execute arbitrary commands on a developer's machine when a user invokes the generator.","categories":["Unclassified"],"product":"Autonomous REST Connector GenAI Agents","vendor":"Progress Software","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-91140","source_modified_at":"2026-10-07T03:55:20.033Z","fetched_at":"2026-10-23T18:52:38.922436Z","product":"Autonomous REST Connector GenAI Agents","vendor":"Progress Software","versions":[{"status":"affected","version":"2.0","lessThan":"2.1","versionType":"custom"}],"defaultStatus":"unaffected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-91140","source_modified_at":"2026-10-07T03:55:20.033Z","fetched_at":"2026-10-23T18:52:38.922436Z","package":{"name":"Autonomous REST Connector GenAI Agents","ecosystem":null},"version":"2.1","basis":"first unaffected version stated in the CVE record"}],"cvss":9.6,"severity":"Critical","kev":{"listed":false},"epss":{"probability":0.01924,"percentile":0.79786,"score_date":"2026-10-23"},"published_at":"2026-10-06T13:46:11.357Z","modified_at":"2026-10-07T03:55:20.033Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-91140","fetched_at":"2026-10-23T18:52:38.922436Z","source_modified_at":"2026-10-07T03:55:20.033Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91140","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/progress/datadirect-arc-ai-model-gen/commit/7ede6d96eb033d647ffdcabf8d8069c098293575","tags":["patch"]},{"source":"CVE List","url":"https://community.progress.com/s/article/Progress-DataDirect-Critical-Security-Alert-Bulletin-September-2026-CVE-2026-91140","tags":["vendor-advisory"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"total","assessed_at":"2026-10-06T00:00:00+00:00"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-07T03:55:20.033Z","content_hash":"790f2a529c99ee9adff0758b0f50c96478875ced53982e91565dda5952cb5618"}}