premAI-io premsql followup.py eval code injection

Successful exploitation of CVE-2026-5594 allows an attacker to execute arbitrary code on the system running premsql. This could lead to complete system compromise, including data exfiltration, modification, or deletion. Given the remote nature of the vulnerability and the availability of a public exploit, the potential impact is significant. An attacker could leverage this to gain persistent access, move laterally within the network if premsql is integrated with other systems, and potentially compromise sensitive data managed by the application. The blast radius extends to any data processed or stored by premsql.

Organizations utilizing premsql in production environments, particularly those with limited security controls or those processing sensitive data, are at significant risk. Environments where premsql is exposed to untrusted external input are especially vulnerable. Users relying on premsql for critical business processes should prioritize mitigation efforts.

• python / server:

import os
import subprocess

def check_premsql_vulnerability():
    try:
        # Check for the vulnerable file
        if os.path.exists('/path/to/premsql/agents/baseline/workers/followup.py'): # Replace with actual path
            # Attempt to trigger the vulnerability (example - replace with actual exploit)
            # This is a placeholder and needs to be adapted to the specific exploit
            subprocess.run(['python', '/path/to/premsql/agents/baseline/workers/followup.py', '--malicious-input'], check=True)
            print('Potential vulnerability detected!')
        else:
            print('premsql not found.')
    except subprocess.CalledProcessError as e:
        print(f'Error during check: {e}')

check_premsql_vulnerability()

1. 2026-04-05Disclosure

   disclosure

2. 2026-04-05PoC

   poc

1. Reserviert2026-04-05
2. Veröffentlicht2026-04-05
3. Geändert2026-04-06
4. EPSS aktualisiert2026-04-13

Due to the lack of a direct patch, mitigation focuses on limiting the attack surface. Implement strict input validation on all data passed to the eval function within premsql/agents/baseline/workers/followup.py. Specifically, sanitize the result argument to prevent malicious code injection. Consider restricting the execution environment of premsql to a sandboxed container with limited privileges. While not a complete solution, this can reduce the potential impact of a successful exploit. Monitor system logs for unusual activity related to premsql, particularly any attempts to execute unexpected commands. Regularly review and update the codebase to address potential vulnerabilities.