Search

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

    2 vulnerabilities found for MindSearch by InternLM

    CVE-2026-105135 (GCVE-0-2026-105135)

    Vulnerability from nvd – Published: 2026-10-04 06:15 – Updated: 2026-10-04 06:15
    VLAI
    Title
    InternLM MindSearch Planner Agent graph.py ExecutionAction.run code injection
    Summary
    A vulnerability has been found in InternLM MindSearch 0.1.0. This issue affects the function ExecutionAction.run of the file mindsearch/agent/graph.py of the component Planner Agent. The manipulation of the argument inputs leads to code injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
    Severity
    10 (Critical)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P
    10 (Critical)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:C
    10 (Critical)
    CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:C
    CWE
    Assigner
    References
    URL Tags
    https://vuldb.com/vuln/413352 vdb-entrytechnical-description
    https://vuldb.com/vuln/413352/cti signaturepermissions-required
    https://vuldb.com/cve/CVE-2026-105135 third-party-advisory
    https://vuldb.com/submit/943315 third-party-advisory
    https://gist.github.com/DReazer/7ad46df9da73d0cf4… exploit
    Impacted products
    Vendor Product Version
    InternLM MindSearch Affected: 0.1.0
        cpe:2.3:a:internlm:mindsearch:*:*:*:*:*:*:*:*
    		Create a notification for this product.
    Credits
    Snkn0w (VulDB User) VulDB CNA Team
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:internlm:mindsearch:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "Planner Agent"
          ],
          "product": "MindSearch",
          "vendor": "InternLM",
          "versions": [
            {
              "status": "affected",
              "version": "0.1.0"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Snkn0w (VulDB User)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "VulDB CNA Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability has been found in InternLM MindSearch 0.1.0. This issue affects the function ExecutionAction.run of the file mindsearch/agent/graph.py of the component Planner Agent. The manipulation of the argument inputs leads to code injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 10,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 10,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 10,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 10,
            "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:ND/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "Code Injection",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-74",
              "description": "Injection",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-04T06:15:12.388Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-413352 | InternLM MindSearch Planner Agent graph.py ExecutionAction.run code injection",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/413352"
        },
        {
          "name": "VDB-413352 | CTI Indicators (IOB, IOC, TTP, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/413352/cti"
        },
        {
          "name": "CVE-2026-105135 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-105135"
        },
        {
          "name": "Submit #943315 | InternLM MindSearch 0.1.0 Code Injection",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/943315"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://gist.github.com/DReazer/7ad46df9da73d0cf414276e4195b2183"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-03T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-10-03T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-10-03T15:24:28.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "InternLM MindSearch Planner Agent graph.py ExecutionAction.run code injection",
      "x_generator": [
        "VulDB PVTS v202610"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-105135",
    "datePublished": "2026-10-04T06:15:12.388Z",
    "dateReserved": "2026-10-03T13:19:23.690Z",
    "dateUpdated": "2026-10-04T06:15:12.388Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-105135 (GCVE-0-2026-105135)

    Vulnerability from cvelistv5 – Published: 2026-10-04 06:15 – Updated: 2026-10-04 06:15
    VLAI
    Title
    InternLM MindSearch Planner Agent graph.py ExecutionAction.run code injection
    Summary
    A vulnerability has been found in InternLM MindSearch 0.1.0. This issue affects the function ExecutionAction.run of the file mindsearch/agent/graph.py of the component Planner Agent. The manipulation of the argument inputs leads to code injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
    Severity
    10 (Critical)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P
    10 (Critical)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:C
    10 (Critical)
    CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:C
    CWE
    Assigner
    References
    URL Tags
    https://vuldb.com/vuln/413352 vdb-entrytechnical-description
    https://vuldb.com/vuln/413352/cti signaturepermissions-required
    https://vuldb.com/cve/CVE-2026-105135 third-party-advisory
    https://vuldb.com/submit/943315 third-party-advisory
    https://gist.github.com/DReazer/7ad46df9da73d0cf4… exploit
    Impacted products
    Vendor Product Version
    InternLM MindSearch Affected: 0.1.0
        cpe:2.3:a:internlm:mindsearch:*:*:*:*:*:*:*:*
    		Create a notification for this product.
    Credits
    Snkn0w (VulDB User) VulDB CNA Team
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:internlm:mindsearch:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "Planner Agent"
          ],
          "product": "MindSearch",
          "vendor": "InternLM",
          "versions": [
            {
              "status": "affected",
              "version": "0.1.0"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Snkn0w (VulDB User)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "VulDB CNA Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability has been found in InternLM MindSearch 0.1.0. This issue affects the function ExecutionAction.run of the file mindsearch/agent/graph.py of the component Planner Agent. The manipulation of the argument inputs leads to code injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 10,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 10,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 10,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 10,
            "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:ND/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "Code Injection",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-74",
              "description": "Injection",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-04T06:15:12.388Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-413352 | InternLM MindSearch Planner Agent graph.py ExecutionAction.run code injection",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/413352"
        },
        {
          "name": "VDB-413352 | CTI Indicators (IOB, IOC, TTP, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/413352/cti"
        },
        {
          "name": "CVE-2026-105135 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-105135"
        },
        {
          "name": "Submit #943315 | InternLM MindSearch 0.1.0 Code Injection",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/943315"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://gist.github.com/DReazer/7ad46df9da73d0cf414276e4195b2183"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-03T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-10-03T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-10-03T15:24:28.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "InternLM MindSearch Planner Agent graph.py ExecutionAction.run code injection",
      "x_generator": [
        "VulDB PVTS v202610"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-105135",
    "datePublished": "2026-10-04T06:15:12.388Z",
    "dateReserved": "2026-10-03T13:19:23.690Z",
    "dateUpdated": "2026-10-04T06:15:12.388Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}