Critical OS Command Injection Vulnerability in Progress Software Autonomous REST Connector GenAI Agents
A critical OS command injection vulnerability, CVE-2026-91140, with a CVSS score of 9.6, has been identified in Progress Software Autonomous REST Connector GenAI Agents ARCGenAI-Generator version 2.0. This vulnerability allows an attacker to execute arbitrary commands on a developer's machine by supplying a crafted Swagger/OpenAPI document. The vulnerability is not actively exploited but poses a significant risk due to its high impact and ease of exploitation. Immediate patching to version 2.1 or later is strongly recommended.