Tools AI Risk Radar ai-incident-0176
Incident record
Progress fixes command injection in its GenAI generator
- Severity
- Critical
- Status
- Patched
- Type
- Infra Vuln
- Target
- Autonomous REST Connector GenAI Agents ARCGenAI-Generator 2.0 before 2.1
- Actor
- researcher
- CVE
- CVE-2026-91140
What happened
A developer running the ARC GenAI generator on crafted Swagger or OpenAPI input could trigger commands supplied by an attacker. The affected tool generates connector code from an API specification.
The affected range is version 2.0 before 2.1. The vendor patch and CVE identify the fix; the CVE, published on 6 October, scores it 9.6 Critical under CVSS 3.1.
Sources
- Primary disclosuregithub.com/progress/datadirect-arc-ai-model-gen/commit/7ede6…
- Supporting advisoryraw.githubusercontent.com/CVEProject/cvelistV5/main/cves/202…
One record from the AI Risk Radar, maintained by the Security Desk.Data: CSV · JSON ·RSS · CC BY 4.0 with attribution to YFarmX.Tracker updated · 13 October 2026