Sixth Remote Code Execution Vulnerability

A remote code execution vulnerability exists in Sixth versions through 0.0.68. The issue arises in the automatic terminal command execution feature, which allows users to execute commands deemed 'safe' by the model without approval. However, this functionality is vulnerable to prompt injection attacks. An attacker can manipulate the model into misclassifying harmful commands as safe, bypassing user consent and enabling arbitrary command execution.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the server where Sixth is running.