CVE-2026-58195
1 advisory.
npm/agentic-flow CVE-2026-58195: high 8.8, EPSS 0.87%
Agentic-Flow: OS Command Injection in agentic-flow MCP server tools via unsanitized tool-parameter interpolation into execSync
Action: Upgrade agentic-flow to 2.0.14 or later.
npm i agentic-flow@2.0.14Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.0.14 | - |
Fixed versions
| 2.0.14 |
Sources
- osv: GHSA-vcv2-r9jh-99m5
- https://github.com/ruvnet/agentic-flow/security/advisories/GHSA-vcv2-r9jh-99m5
- https://github.com/ruvnet/agentic-flow/issues/169
- https://github.com/ruvnet/ruflo/issues/2414
- https://github.com/ruvnet/agentic-flow/pull/170
- https://github.com/ruvnet/ruflo/pull/2415
- https://github.com/ruvnet/agentic-flow
- https://github.com/ruvnet/ruflo/releases/tag/v3.12.4
- https://www.npmjs.com/package/agentic-flow/v/2.0.14
CVE-2026-58195 · published · modified · JSON