CVE-2026-105135

critical

Description

A vulnerability has been found in InternLM MindSearch 0.1.0. This issue affects the function ExecutionAction.run of the file mindsearch/agent/graph.py of the component Planner Agent. The manipulation of the argument inputs leads to code injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

References

https://vuldb.com/vuln/413352/cti

https://vuldb.com/vuln/413352

https://vuldb.com/submit/943315

https://vuldb.com/cve/CVE-2026-105135

https://gist.github.com/DReazer/7ad46df9da73d0cf414276e4195b2183

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-92077

Details

Source: Mitre, NVD

Published: 2026-10-04

Updated: 2026-10-06

Risk Information

CVSS v2

Base Score: 10

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Severity: Critical

CVSS v3

Base Score: 10

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Severity: Critical

CVSS v4

Base Score: 10

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Severity: Critical

EPSS

EPSS: 0.0077