9.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-31236

CVE-2026-31236: llm CLI tool contains a code injection vulnerability via `--functions` command-line argument

The llm CLI tool thru 0.27.1 contains a critical code injection vulnerability via its --functions command-line argument. This argument is intended to allow users to provide custom Python function definitions. However, the tool directly executes the provided code using the unsafe exec() function without any sanitization, sandboxing, or security restrictions. An attacker can exploit this by crafting a malicious llm command with arbitrary Python code in the --functions argument and using social engineering to trick a victim into running it. This leads to arbitrary code execution on the victim's system, potentially granting the attacker full control.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-31236

CVE-2026-31236:

9.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
llm	pip	<= 0.27.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a code injection weakness in the llm command-line tool, specifically affecting version 0.27.1 and earlier. The root cause lies in the handling of the --functions command-line argument, which is intended for users to define custom Python functions as tools for the language model. The application fails to properly sanitize or restrict the input provided to this argument.

The user-provided string is passed to the _tools_from_code function within llm/cli.py. This function directly uses the exec() function to execute the input string as Python code. This allows an attacker to inject and execute arbitrary Python code on the system running the llm tool. The vulnerability can be triggered through several commands that accept the --functions argument, including llm prompt, llm chat, and llm tools list. An attacker could exploit this by tricking a user into executing a malicious llm command, leading to a full compromise of the user's system.

Vulnerable functions

_tools_from_code

llm/cli.py

This function is the core of the vulnerability. It takes a string `code_or_path` which originates from the `--functions` command-line argument and executes it as Python code using the `exec()` function. There is no sanitization, sandboxing, or validation of the input, which allows for arbitrary code execution.

_gather_tools

llm/cli.py

This function receives the list of user-provided code strings from the `python_tools` argument and passes each of them to the `_tools_from_code` function, which contains the vulnerable `exec()` call. It is a key part of the vulnerable call chain.

prompt

llm/cli.py

This function defines the `prompt` command for the CLI. It includes the `--functions` option, which accepts the malicious input. The value of this option is then passed down to the `_gather_tools` function, initiating the vulnerable execution flow.

chat

llm/cli.py

Similar to the `prompt` command, the `chat` command also accepts the `--functions` argument. It serves as another entry point for the vulnerability, passing the user-provided code to the `_gather_tools` function.

tools_list

llm/cli.py

The `tools list` command is another entry point for the vulnerability. It also has the `--functions` option and passes the input to either `_gather_tools` or directly to `_tools_from_code`, leading to arbitrary code execution.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.