Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HSummary
CVE-2026-30306 is a critical-severity Code Injection (CWE-94) vulnerability in Rahmanazhar Sakadev. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Command and Scripting Interpreter (T1059); ranked at the 49th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
This vulnerability is AI-related — categorised as LLM Application Platforms; in the LLM/Generative AI Risks risk domain.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SI-10 (Information Input Validation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-30306 is a critical vulnerability (CVSS 9.8, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) affecting SakaDev, a Visual Studio Code extension for terminal command execution. The flaw resides in SakaDev's design for automatic command execution, which provides two options: "Execute safe commands" and "execute all commands." In safe mode, an LLM model classifies commands as safe for automatic execution or potentially destructive, requiring user approval. This mechanism is susceptible to prompt injection attacks (CWE-94), allowing attackers to bypass safety checks.
A remote attacker can exploit this vulnerability without authentication or user interaction by crafting a generic prompt template that wraps arbitrary malicious commands. The injected prompt misleads the LLM into misclassifying the payload as safe, enabling automatic execution and resulting in full arbitrary command execution on the victim's system, with high impact on confidentiality, integrity, and availability.
Mitigation details are available in the referenced advisories, including the GitHub issue at https://github.com/Secsys-FDU/LLM-Tool-Calling-CVEs/issues/4 and the extension listing at https://marketplace.visualstudio.com/items?itemName=rahmanazhar.saka-dev.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-17203
Vulnerability Data
In its design for automatic terminal command execution, SakaDev offers two options: Execute safe commands and execute all commands. The description for the former states that commands determined by the model to be safe will be automatically executed, whereas if…
more
the model judges a command to be potentially destructive, it still requires user approval. However, this design is highly susceptible to prompt injection attacks. An attacker can employ a generic template to wrap any malicious command and mislead the model into misclassifying it as a 'safe' command, thereby bypassing the user approval requirement and resulting in arbitrary command execution.
- CWE(s)
AI Security AnalysisAI
- AI Category
- LLM Application Platforms
- Risk Domain
- LLM/Generative AI Risks
- OWASP Top 10 for LLMs 2025
- None mapped
- AI-specific weaknesses CR
- CWE-1427 — Prompt injection misleads model safety judgment; unsafe output reaches execution sink.
Mapped by Cyber Resilience · not in NVD. Poisoning and extraction cases are routed to MITRE ATLAS instead of a synthetic CWE.- Classification Reason
- Matched keywords: prompt injection
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V1.3.1
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation finds code paths that accept and execute externally influenced strings.
Input validation directly stops untrusted data from being used to construct executable code without neutralization.
Least privilege limits the damage an injected code fragment can perform once executed.
Requiring documented secure development standards and tools enforces use of safe code-generation APIs and escaping.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
PR.PS-06's SDLC practices directly target injection flaws via secure coding and testing (mostly), yet as a single broad outcome it leaves many code-generation specifics unaddressed (partial).
PR.DS-10 protects runtime data confidentiality/integrity but has no bearing on neutralizing externally influenced input during code generation, so neither direction shows any preventive effect.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Banning unapproved code samples and unauthenticated web services, combined with secure-coding standards and SAST, prevents the dynamic generation or inclusion of attacker-supplied code.
Controls that restrict unauthorized or malicious code from being introduced via external networks or removable media limit opportunities for an attacker to inject and execute arbitrary code.