CVE-2026-30308

CriticalRCE

Published: 30 March 2026

Published

30 March 2026

Modified

08 April 2026

KEV Added

—

Patch

—

CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0009 25.8th percentile

Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-30308 is a critical-severity Code Injection (CWE-94) vulnerability in Presidio Hai Build. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 25.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

This vulnerability is AI-related — categorised as Other AI Platforms; in the LLM/Generative AI Risks risk domain.

The strongest mitigations our analysis identified are NIST 800-53 CM-7 (Least Functionality) and SI-10 (Information Input Validation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match

prevent

Directly mitigates prompt injection attacks by validating and sanitizing user inputs to the AI model used for command safety classification.

CM-7 Least Functionality good match

prevent

Restricts the vulnerable 'Execute safe commands' mode to least functionality, forcing user approval for all commands and preventing automatic execution of misclassified malicious ones.

SI-15 Information Output Filtering partial match

prevent

Filters generated commands before execution to block malicious payloads even if the AI model misclassifies them as safe due to prompt injection.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1059 Command and Scripting Interpreter Execution

Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries.

attack.mitre.org →

Why these techniques?

Remote unauthenticated prompt injection in a public-facing code generator directly enables arbitrary terminal command execution (T1059) via exploitation of the exposed application (T1190).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

In its design for automatic terminal command execution, HAI Build Code Generator offers two options: Execute safe commands and Execute all commands. The description for the former states that commands determined by the model to be safe will be automatically…

executed, whereas if the model judges a command to be potentially destructive, it still requires user approval. However, this design is highly susceptible to prompt injection attacks. An attacker can employ a generic template to wrap any malicious command and mislead the model into misclassifying it as a 'safe' command, thereby bypassing the user approval requirement and resulting in arbitrary command execution.

Deeper analysisAI

CVE-2026-30308 is a critical vulnerability in the HAI Build Code Generator, a tool that supports automatic terminal command execution with two modes: "Execute safe commands" and "Execute all commands." In the safe mode, a model evaluates commands, automatically executing those deemed safe while requiring user approval for potentially destructive ones. The flaw stems from this design's susceptibility to prompt injection attacks (CWE-94), where attackers can craft inputs to trick the model into misclassifying malicious commands as safe, bypassing approval entirely.

The vulnerability enables remote attackers with no privileges or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, score 9.8) to achieve arbitrary command execution on the target's system. By using a generic template to wrap malicious payloads, an attacker can mislead the model during command generation or processing, leading to unauthorized execution of destructive actions such as data exfiltration, system compromise, or further persistence.

Mitigation details and advisories are available in the referenced sources, including the GitHub issue at https://github.com/Secsys-FDU/LLM-Tool-Calling-CVEs/issues/10 and the project repository at https://github.com/presidio-oss/hai-build. Security practitioners should review these for patches, workarounds, or updated configurations to address the prompt injection risk.