{"metadata": {"vulnerability": "CVE-2026-67547", "count": 9, "kinds": {"milestone": 3, "sighting": 3, "kev": 0, "other": 3}, "linked_omitted": 0}, "data": [{"timestamp": "2026-07-29T18:47:17.074Z", "date_only": false, "value": "2026-07-29T18:47:17.074Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-67547", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-11-11T21:46:37.959Z", "date_only": false, "value": "2026-11-11T21:46:37.959Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-67547", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-11T21:46:37.959Z", "date_only": false, "value": "2026-11-11T21:46:37.959Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-67547", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-11-11T21:46:37.959Z", "date_only": false, "value": "2026-11-11T21:46:37.959Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "CVE-2026-67547", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-11T22:17:29.710Z", "date_only": false, "value": "2026-11-11T22:17:29.710", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-67547", "record": "FKIE_CVE-2026-67547", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-11T22:17:29.710Z", "date_only": false, "value": "2026-11-11T22:17:29.710", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-67547", "record": "FKIE_CVE-2026-67547", "field": "lastModified", "linked_record": true}, {"timestamp": "2026-11-11T22:45:34.239Z", "date_only": false, "value": "2026-11-11T22:45:34.239263Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117600231997692015", "record": "CVE-2026-67547", "field": "creation_timestamp", "uuid": "fc7e1a9e-0589-48c3-b81b-d6ad29fddf80", "content": "CVE-2026-67547 taOS: Authenticated Non-Admin Host Code Execution via Skill Runtime taOS is a self-hosted AI agent OS. Prior to version 1.0.0-beta.23, the POST /api/skill-exec/{skill_id}/call endpoint in taOS executes built-in skills \u2014 including the code_exec skill which runs arbitrary Python via subprocess.run([\"python3\", \"-c\", code]) \u2014 without performing any admin role check, skill ownership check, or agent assignment verification. Any authenticated non-admin user can supply attacker-controlled Python code in the request body and have it executed as the taOS backend process user on the host, achieving full remote code execution with no privilege escalation required beyond a valid (non-admin) session. This issue has been patched in version 1.0.0-beta.23.\nhttps://www.cve.org/CVERecord?id=CVE-2026-67547https://github.com/jaylfc/taOS/security/advisories/GHSA-h24f-gp4c-8qjmhttps://github.com/jaylfc/taOS/commit/8998d85190424d5e843880b4ca256e79b653a304https://github.com/jaylfc/taOS/releases/tag/v1.0.0-beta.23#jaylfc #taOS#CVE_2026_67547#bot", "url": "https://infosec.exchange/users/cve/statuses/117600231997692015"}, {"timestamp": "2026-11-11T23:43:47.040Z", "date_only": false, "value": "2026-11-11T23:43:47.040675Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/56lmdhdkfgcu6", "record": "CVE-2026-67547", "field": "creation_timestamp", "uuid": "c5bf9d03-d06a-4bf4-a70a-29f30de3cc41", "content": "CVE-2026-67547 - taOS: Authenticated Non-Admin Host Code Execution via Skill Runtime\nCVE ID : CVE-2026-67547\n \n Published : Nov. 11, 2026, 10:17 p.m. | 58\u00a0minutes ago\n \n Description : taOS is a self-hosted AI agent OS. Prior to version 1.0.0-beta.23, the POST /api/skill-exec/{...", "url": "https://bsky.app/profile/cve.skyfleet.blue/post/56lmdhdkfgcu6"}, {"timestamp": "2026-11-12T01:02:23.328Z", "date_only": false, "value": "2026-11-12T01:02:23.328533Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3n23bimyui52g", "record": "CVE-2026-67547", "field": "creation_timestamp", "uuid": "e90db978-8aa4-4a80-930f-b8871cdd3e5f", "content": "\ud83d\udfe0 CVE-2026-67547 - High (8.8)\n\ntaOS is a self-hosted AI agent OS. Prior to version 1.0.0-beta.23, the POST /api/skill-exec/{skil...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-67547/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "url": "https://bsky.app/profile/thehackerwire.bsky.social/post/3n23bimyui52g"}], "metrics": {"as_of": "2026-11-12T05:09:40.973Z", "anchors": {"origin": {"timestamp": "2026-11-11T21:46:37.959Z", "date_only": false, "value": "2026-11-11T21:46:37.959Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-67547", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-11-11T21:46:37.959Z", "date_only": false, "value": "2026-11-11T21:46:37.959Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-67547", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 26583.014005, "hours": 7.3841705569444445, "days": 0.3076737732060185, "min_seconds": 26583.014005, "max_seconds": 26583.014005, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-11-11T21:46:37.959Z", "date_only": false, "value": "2026-11-11T21:46:37.959Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-67547", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-12T05:09:40.973Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}