Actions: command injection

beenuar AiSOC

AiSOC versions 7.2.0 before 12.0.0 contain a command injection vulnerability in the actions service that builds CrowdStrike Real Time Response command strings by interpolating unescaped action parameters in crowdstrike_rtr.py and endpoint.py.

Fix it

Upgrade to AiSOC 12.0.0

First seen: 30 Oct 2026
Last update: 30 Oct 2026, 18:18 UTC
Fixed in: 12.0.0
Identifiers: CVE-2026-103056
CVSS: 9.0
Source: news

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## Actions: command injection
Severity: critical. Patch status: patched.
Affected: beenuar AiSOC
Fixed in: 12.0.0
Ids: CVE-2026-103056

AiSOC versions 7.2.0 before 12.0.0 contain a command injection vulnerability in the actions service that builds CrowdStrike Real Time Response command strings by interpolating unescaped action parameters in crowdstrike_rtr.py and endpoint.py.

## Steps
1. Search the repo, its CI and infra config for beenuar AiSOC. If present, report the version in use and whether it's affected.
2. Fix by release line: AiSOC: 12.0.0.

## Fix by release line
| Line | State | Fix | Until then |
|---|---|---|---|
| AiSOC | fixed | 12.0.0 | — |

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2026-103056") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://github.com/beenuar/AiSOC/blob/v11.2.0/services/actions/app/clients/crowdstrike_rtr.py#L273 https://nvd.nist.gov/vuln/detail/CVE-2026-103056
https://pwned.coffee/i/actions-command-injection-cve-2026-103056

Timeline

30 Oct 2026, 18:19 UTC
Fix status: unknown → patched.
30 Oct 2026
First reported.

Receipt

Exploitation: Public exploit code, no attacks reported
CISA ADP “CISA ADP rates exploitation of CVE-2026-103056 "poc" (SSVC).” source
Fix by release line: Product Affected Fixed in Source
AiSOC before 12.0.0 12.0.0 CVE record (CNA) checked 30 Oct
Score: CVSS 9.0 (critical). CVSS 3.1 9 (CNA VulnCheck) for CVE-2026-103056
Last checked: 30 Oct 2026, 18:35 UTC

Product	Affected	Fixed in	Source
AiSOC	before 12.0.0	12.0.0	CVE record (CNA) checked 30 Oct

Sources: KEV – CVE record ✓ Vendor ✓

Sources

Wrong fix version, or a source we missed? Send it back to chef@pwned.coffee with the source, and we'll correct it here.

Totalone very hot coffee