HAI Build Code Generator Remote Code Execution Vulnerability

A remote code execution vulnerability exists in HAI Build Code Generator versions through 3.13.3. The issue arises in the tool's automatic terminal command execution feature, which includes options to execute safe commands or all commands. Commands deemed safe by the model are executed automatically, while potentially destructive commands require user approval. However, this design is vulnerable to prompt injection attacks. An attacker can use a generic template to disguise malicious commands as safe, bypassing the approval process and allowing arbitrary command execution.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the host system.