CVE-2026-51881

deeptutor 1.4.0 contains code injection in ExecTool.execute

Risk score: 69/100
CVSS: 9.8 v3.1
Exploit chance (30 days): 0.3%
Published: 1 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is: deeptutor 1.4.0 contains code injection in ExecTool.execute. Through the live tutorbot WebSocket interface, a remote caller can induce the tool layer to execute reviewer-chosen shell commands in the service environment.
Affected: See advisory
Fix: Apply the vendor's security update; see the linked advisory.
Exploitation: No known exploitation

Why it is Amber

CVSS 9.8 critical
Remotely exploitable without logging in

References

https://gist.github.com/Ro1ME/77331f8ae45f617d33f7100c3f48cac5
https://github.com/HKUDS/DeepTutor/issues/518
https://github.com/HKUDS/DeepTutor/issues/518

Original description

deeptutor 1.4.0 contains code injection in ExecTool.execute. Through the live tutorbot WebSocket interface, a remote caller can induce the tool layer to execute reviewer-chosen shell commands in the service environment.

Last activity 1 Oct 2026. Patch Forecast updates every hour.