Code Injection in FinRobot 1.0.0

Executive Summary

CVE-2026-51918 is a code injection vulnerability in FinRobot 1.0.0. It exists in the CodingUtils.create_file_with_code() method in finrobot/functional/coding.py. The function accepts file paths from LLM tool invocations without validation. When FinRobot's autogen session is exposed via HTTP or an interactive interface, attackers can use prompt injection to manipulate the LLM into invoking this method with paths outside the intended workspace. This allows arbitrary file creation, potentially enabling backdoors, web shells, or malicious scripts in system directories.

Useful 0 Not Useful 0

Detection Guidance

Check FinRobot logs for suspicious file creation events, especially outside the intended workspace. Look for commands invoking CodingUtils.create_file_with_code with paths containing ../ or absolute paths. Monitor HTTP requests to FinRobot's autogen session for prompt injection attempts.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to create files anywhere on the system by exploiting prompt injection through FinRobot's interface. Potential impacts include deploying web shells for remote code execution, installing persistent backdoors, or modifying critical system files. Attackers could gain unauthorized access, execute arbitrary commands, or maintain long-term control over the affected system.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized file creation and potential data breaches, violating GDPR's data protection requirements and HIPAA's security rules for protected health information. It may result in non-compliance due to insufficient access controls, lack of audit trails for file operations, and inadequate protection against arbitrary code execution.

Useful 0 Not Useful 0

Mitigation Strategies

Disable the CodingUtils.create_file_with_code function if not essential. Implement strict path validation using os.path.normpath and os.path.commonpath to restrict file creation to the intended directory. Filter directory traversal sequences like ../ in user inputs. Update FinRobot to a patched version if available.

Useful 0 Not Useful 0