Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
4 vulnerabilities by mannaandpoem
CVE-2025-2954 (GCVE-0-2025-2954)
Vulnerability from nvd – Published: 2025-03-30 16:31 – Updated: 2025-03-31 13:04
VLAI
EPSS
VEX
Title
mannaandpoem OpenManus File file_saver.py execute access control
Summary
A vulnerability, which was classified as problematic, was found in mannaandpoem OpenManus up to 2025.3.13. This affects the function execute of the file app/tool/file_saver.py of the component File Handler. The manipulation leads to improper access controls. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/?id.302007 | vdb-entrytechnical-description |
| https://vuldb.com/?ctiid.302007 | signaturepermissions-required |
| https://vuldb.com/?submit.521545 | third-party-advisory |
| https://magnificent-dill-351.notion.site/Arbitrar… | exploit |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| mannaandpoem | OpenManus |
Affected:
2025.3.0
Affected: 2025.3.1 Affected: 2025.3.2 Affected: 2025.3.3 Affected: 2025.3.4 Affected: 2025.3.5 Affected: 2025.3.6 Affected: 2025.3.7 Affected: 2025.3.8 Affected: 2025.3.9 Affected: 2025.3.10 Affected: 2025.3.11 Affected: 2025.3.12 Affected: 2025.3.13 |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-2954",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-03-31T13:04:20.884552Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-03-31T13:04:26.725Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://magnificent-dill-351.notion.site/Arbitrary-File-Writing-in-OpenManus-2025-3-13-1b9c693918ed805e8e7fd35a896d2d41"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"modules": [
"File Handler"
],
"product": "OpenManus",
"vendor": "mannaandpoem",
"versions": [
{
"status": "affected",
"version": "2025.3.0"
},
{
"status": "affected",
"version": "2025.3.1"
},
{
"status": "affected",
"version": "2025.3.2"
},
{
"status": "affected",
"version": "2025.3.3"
},
{
"status": "affected",
"version": "2025.3.4"
},
{
"status": "affected",
"version": "2025.3.5"
},
{
"status": "affected",
"version": "2025.3.6"
},
{
"status": "affected",
"version": "2025.3.7"
},
{
"status": "affected",
"version": "2025.3.8"
},
{
"status": "affected",
"version": "2025.3.9"
},
{
"status": "affected",
"version": "2025.3.10"
},
{
"status": "affected",
"version": "2025.3.11"
},
{
"status": "affected",
"version": "2025.3.12"
},
{
"status": "affected",
"version": "2025.3.13"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "s0l42 (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability, which was classified as problematic, was found in mannaandpoem OpenManus up to 2025.3.13. This affects the function execute of the file app/tool/file_saver.py of the component File Handler. The manipulation leads to improper access controls. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
},
{
"lang": "de",
"value": "Es wurde eine problematische Schwachstelle in mannaandpoem OpenManus bis 2025.3.13 gefunden. Es geht dabei um die Funktion execute der Datei app/tool/file_saver.py der Komponente File Handler. Mit der Manipulation mit unbekannten Daten kann eine improper access controls-Schwachstelle ausgenutzt werden. Der Angriff muss lokal erfolgen. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 3.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 3.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 1.7,
"vectorString": "AV:L/AC:L/Au:S/C:N/I:P/A:N",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "Improper Access Controls",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-266",
"description": "Incorrect Privilege Assignment",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-03-30T16:31:05.242Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-302007 | mannaandpoem OpenManus File file_saver.py execute access control",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/?id.302007"
},
{
"name": "VDB-302007 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.302007"
},
{
"name": "Submit #521545 | OpenManus 2025.3.13 Arbitrary File Writing",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/?submit.521545"
},
{
"tags": [
"exploit"
],
"url": "https://magnificent-dill-351.notion.site/Arbitrary-File-Writing-in-OpenManus-2025-3-13-1b9c693918ed805e8e7fd35a896d2d41"
}
],
"timeline": [
{
"lang": "en",
"time": "2025-03-29T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2025-03-29T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2025-03-29T20:44:18.000Z",
"value": "VulDB entry last update"
}
],
"title": "mannaandpoem OpenManus File file_saver.py execute access control"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2025-2954",
"datePublished": "2025-03-30T16:31:05.242Z",
"dateReserved": "2025-03-29T19:39:01.052Z",
"dateUpdated": "2025-03-31T13:04:26.725Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-2733 (GCVE-0-2025-2733)
Vulnerability from nvd – Published: 2025-03-25 04:31 – Updated: 2025-03-25 13:29
VLAI
EPSS
VEX
Title
mannaandpoem OpenManus Prompt python_execute.py os command injection
Summary
A vulnerability classified as critical has been found in mannaandpoem OpenManus up to 2025.3.13. This affects an unknown part of the file app/tool/python_execute.py of the component Prompt Handler. The manipulation leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
6.3 (Medium)
6.3 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/?id.300753 | vdb-entry |
| https://vuldb.com/?ctiid.300753 | signaturepermissions-required |
| https://vuldb.com/?submit.520426 | third-party-advisory |
| https://magnificent-dill-351.notion.site/Command-… | exploit |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| mannaandpoem | OpenManus |
Affected:
2025.3.0
Affected: 2025.3.1 Affected: 2025.3.2 Affected: 2025.3.3 Affected: 2025.3.4 Affected: 2025.3.5 Affected: 2025.3.6 Affected: 2025.3.7 Affected: 2025.3.8 Affected: 2025.3.9 Affected: 2025.3.10 Affected: 2025.3.11 Affected: 2025.3.12 Affected: 2025.3.13 |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-2733",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-03-25T13:28:59.625183Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-03-25T13:29:14.439Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"modules": [
"Prompt Handler"
],
"product": "OpenManus",
"vendor": "mannaandpoem",
"versions": [
{
"status": "affected",
"version": "2025.3.0"
},
{
"status": "affected",
"version": "2025.3.1"
},
{
"status": "affected",
"version": "2025.3.2"
},
{
"status": "affected",
"version": "2025.3.3"
},
{
"status": "affected",
"version": "2025.3.4"
},
{
"status": "affected",
"version": "2025.3.5"
},
{
"status": "affected",
"version": "2025.3.6"
},
{
"status": "affected",
"version": "2025.3.7"
},
{
"status": "affected",
"version": "2025.3.8"
},
{
"status": "affected",
"version": "2025.3.9"
},
{
"status": "affected",
"version": "2025.3.10"
},
{
"status": "affected",
"version": "2025.3.11"
},
{
"status": "affected",
"version": "2025.3.12"
},
{
"status": "affected",
"version": "2025.3.13"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "s0l42 (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability classified as critical has been found in mannaandpoem OpenManus up to 2025.3.13. This affects an unknown part of the file app/tool/python_execute.py of the component Prompt Handler. The manipulation leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
},
{
"lang": "de",
"value": "Es wurde eine Schwachstelle in mannaandpoem OpenManus bis 2025.3.13 entdeckt. Sie wurde als kritisch eingestuft. Dabei betrifft es einen unbekannter Codeteil der Datei app/tool/python_execute.py der Komponente Prompt Handler. Mit der Manipulation mit unbekannten Daten kann eine os command injection-Schwachstelle ausgenutzt werden. Die Umsetzung des Angriffs kann dabei \u00fcber das Netzwerk erfolgen. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "OS Command Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "Command Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-03-25T04:31:04.535Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-300753 | mannaandpoem OpenManus Prompt python_execute.py os command injection",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/?id.300753"
},
{
"name": "VDB-300753 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.300753"
},
{
"name": "Submit #520426 | OpenManus 2025.3.13 OS Command Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/?submit.520426"
},
{
"tags": [
"exploit"
],
"url": "https://magnificent-dill-351.notion.site/Command-Execution-in-Openmanus-2025-3-13-1b6c693918ed80b2826ef6bb385693fa"
}
],
"timeline": [
{
"lang": "en",
"time": "2025-03-24T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2025-03-24T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2025-03-24T14:07:41.000Z",
"value": "VulDB entry last update"
}
],
"title": "mannaandpoem OpenManus Prompt python_execute.py os command injection"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2025-2733",
"datePublished": "2025-03-25T04:31:04.535Z",
"dateReserved": "2025-03-24T13:02:37.407Z",
"dateUpdated": "2025-03-25T13:29:14.439Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-2954 (GCVE-0-2025-2954)
Vulnerability from cvelistv5 – Published: 2025-03-30 16:31 – Updated: 2025-03-31 13:04
VLAI
EPSS
VEX
Title
mannaandpoem OpenManus File file_saver.py execute access control
Summary
A vulnerability, which was classified as problematic, was found in mannaandpoem OpenManus up to 2025.3.13. This affects the function execute of the file app/tool/file_saver.py of the component File Handler. The manipulation leads to improper access controls. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/?id.302007 | vdb-entrytechnical-description |
| https://vuldb.com/?ctiid.302007 | signaturepermissions-required |
| https://vuldb.com/?submit.521545 | third-party-advisory |
| https://magnificent-dill-351.notion.site/Arbitrar… | exploit |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| mannaandpoem | OpenManus |
Affected:
2025.3.0
Affected: 2025.3.1 Affected: 2025.3.2 Affected: 2025.3.3 Affected: 2025.3.4 Affected: 2025.3.5 Affected: 2025.3.6 Affected: 2025.3.7 Affected: 2025.3.8 Affected: 2025.3.9 Affected: 2025.3.10 Affected: 2025.3.11 Affected: 2025.3.12 Affected: 2025.3.13 |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-2954",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-03-31T13:04:20.884552Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-03-31T13:04:26.725Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://magnificent-dill-351.notion.site/Arbitrary-File-Writing-in-OpenManus-2025-3-13-1b9c693918ed805e8e7fd35a896d2d41"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"modules": [
"File Handler"
],
"product": "OpenManus",
"vendor": "mannaandpoem",
"versions": [
{
"status": "affected",
"version": "2025.3.0"
},
{
"status": "affected",
"version": "2025.3.1"
},
{
"status": "affected",
"version": "2025.3.2"
},
{
"status": "affected",
"version": "2025.3.3"
},
{
"status": "affected",
"version": "2025.3.4"
},
{
"status": "affected",
"version": "2025.3.5"
},
{
"status": "affected",
"version": "2025.3.6"
},
{
"status": "affected",
"version": "2025.3.7"
},
{
"status": "affected",
"version": "2025.3.8"
},
{
"status": "affected",
"version": "2025.3.9"
},
{
"status": "affected",
"version": "2025.3.10"
},
{
"status": "affected",
"version": "2025.3.11"
},
{
"status": "affected",
"version": "2025.3.12"
},
{
"status": "affected",
"version": "2025.3.13"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "s0l42 (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability, which was classified as problematic, was found in mannaandpoem OpenManus up to 2025.3.13. This affects the function execute of the file app/tool/file_saver.py of the component File Handler. The manipulation leads to improper access controls. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
},
{
"lang": "de",
"value": "Es wurde eine problematische Schwachstelle in mannaandpoem OpenManus bis 2025.3.13 gefunden. Es geht dabei um die Funktion execute der Datei app/tool/file_saver.py der Komponente File Handler. Mit der Manipulation mit unbekannten Daten kann eine improper access controls-Schwachstelle ausgenutzt werden. Der Angriff muss lokal erfolgen. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 3.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 3.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 1.7,
"vectorString": "AV:L/AC:L/Au:S/C:N/I:P/A:N",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "Improper Access Controls",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-266",
"description": "Incorrect Privilege Assignment",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-03-30T16:31:05.242Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-302007 | mannaandpoem OpenManus File file_saver.py execute access control",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/?id.302007"
},
{
"name": "VDB-302007 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.302007"
},
{
"name": "Submit #521545 | OpenManus 2025.3.13 Arbitrary File Writing",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/?submit.521545"
},
{
"tags": [
"exploit"
],
"url": "https://magnificent-dill-351.notion.site/Arbitrary-File-Writing-in-OpenManus-2025-3-13-1b9c693918ed805e8e7fd35a896d2d41"
}
],
"timeline": [
{
"lang": "en",
"time": "2025-03-29T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2025-03-29T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2025-03-29T20:44:18.000Z",
"value": "VulDB entry last update"
}
],
"title": "mannaandpoem OpenManus File file_saver.py execute access control"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2025-2954",
"datePublished": "2025-03-30T16:31:05.242Z",
"dateReserved": "2025-03-29T19:39:01.052Z",
"dateUpdated": "2025-03-31T13:04:26.725Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-2733 (GCVE-0-2025-2733)
Vulnerability from cvelistv5 – Published: 2025-03-25 04:31 – Updated: 2025-03-25 13:29
VLAI
EPSS
VEX
Title
mannaandpoem OpenManus Prompt python_execute.py os command injection
Summary
A vulnerability classified as critical has been found in mannaandpoem OpenManus up to 2025.3.13. This affects an unknown part of the file app/tool/python_execute.py of the component Prompt Handler. The manipulation leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
6.3 (Medium)
6.3 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/?id.300753 | vdb-entry |
| https://vuldb.com/?ctiid.300753 | signaturepermissions-required |
| https://vuldb.com/?submit.520426 | third-party-advisory |
| https://magnificent-dill-351.notion.site/Command-… | exploit |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| mannaandpoem | OpenManus |
Affected:
2025.3.0
Affected: 2025.3.1 Affected: 2025.3.2 Affected: 2025.3.3 Affected: 2025.3.4 Affected: 2025.3.5 Affected: 2025.3.6 Affected: 2025.3.7 Affected: 2025.3.8 Affected: 2025.3.9 Affected: 2025.3.10 Affected: 2025.3.11 Affected: 2025.3.12 Affected: 2025.3.13 |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-2733",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-03-25T13:28:59.625183Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-03-25T13:29:14.439Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"modules": [
"Prompt Handler"
],
"product": "OpenManus",
"vendor": "mannaandpoem",
"versions": [
{
"status": "affected",
"version": "2025.3.0"
},
{
"status": "affected",
"version": "2025.3.1"
},
{
"status": "affected",
"version": "2025.3.2"
},
{
"status": "affected",
"version": "2025.3.3"
},
{
"status": "affected",
"version": "2025.3.4"
},
{
"status": "affected",
"version": "2025.3.5"
},
{
"status": "affected",
"version": "2025.3.6"
},
{
"status": "affected",
"version": "2025.3.7"
},
{
"status": "affected",
"version": "2025.3.8"
},
{
"status": "affected",
"version": "2025.3.9"
},
{
"status": "affected",
"version": "2025.3.10"
},
{
"status": "affected",
"version": "2025.3.11"
},
{
"status": "affected",
"version": "2025.3.12"
},
{
"status": "affected",
"version": "2025.3.13"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "s0l42 (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability classified as critical has been found in mannaandpoem OpenManus up to 2025.3.13. This affects an unknown part of the file app/tool/python_execute.py of the component Prompt Handler. The manipulation leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
},
{
"lang": "de",
"value": "Es wurde eine Schwachstelle in mannaandpoem OpenManus bis 2025.3.13 entdeckt. Sie wurde als kritisch eingestuft. Dabei betrifft es einen unbekannter Codeteil der Datei app/tool/python_execute.py der Komponente Prompt Handler. Mit der Manipulation mit unbekannten Daten kann eine os command injection-Schwachstelle ausgenutzt werden. Die Umsetzung des Angriffs kann dabei \u00fcber das Netzwerk erfolgen. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "OS Command Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "Command Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-03-25T04:31:04.535Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-300753 | mannaandpoem OpenManus Prompt python_execute.py os command injection",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/?id.300753"
},
{
"name": "VDB-300753 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.300753"
},
{
"name": "Submit #520426 | OpenManus 2025.3.13 OS Command Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/?submit.520426"
},
{
"tags": [
"exploit"
],
"url": "https://magnificent-dill-351.notion.site/Command-Execution-in-Openmanus-2025-3-13-1b6c693918ed80b2826ef6bb385693fa"
}
],
"timeline": [
{
"lang": "en",
"time": "2025-03-24T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2025-03-24T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2025-03-24T14:07:41.000Z",
"value": "VulDB entry last update"
}
],
"title": "mannaandpoem OpenManus Prompt python_execute.py os command injection"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2025-2733",
"datePublished": "2025-03-25T04:31:04.535Z",
"dateReserved": "2025-03-24T13:02:37.407Z",
"dateUpdated": "2025-03-25T13:29:14.439Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}