vulnti.work

In its design for automatic terminal command execution, Sixth offers two options: Execute safe commands and Execute all commands. The description for the former states that commands determined by the…

Critical CVSS 9.8
CVECVE-2026-30310
First seen2026-07-25 11:16 UTC
Disclosed2026-03-31 14:16 UTC
Last updated2026-07-25 11:16 UTC
Channel statusauto

Summary

In its design for automatic terminal command execution, Sixth offers two options: Execute safe commands and Execute all commands. The description for the former states that commands determined by the model to be safe will be automatically executed, whereas if the model judges a command to be potentially destructive, it still requires user approval. However, this design is highly susceptible to prompt injection attacks. An attacker can employ a generic template to wrap any malicious command and …

In-depth triage · Auto channel

No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).

Lint boundary warnings (1)

The following non-blocking warnings were raised during the lint phase of this triage (e.g. reference URLs not yet on the allowlist). They do not affect entry usability and are disclosed for transparency (see DR-002).

  • REF_URL_NOT_ALLOWLISTED url not in allowlist: https://trysixth.com/

Sources

  • NVD DATABASE

Original Links

Timeline

  1. nvd_ingest NVD