CVE-2026-91140: Command Injection in Progress ARCGenAI-Generator

A crafted Swagger/OpenAPI document could influence shell-based temporary-file cleanup in ARCGenAI-Generator 2.0 when a developer invoked it. Progress fixed the unsafe workflow in 2.1; the advisory does not report active exploitation.^{[1], [3], [4]}

💡 Plain English Explainer (ELI5)

A workshop cleanup instruction receives a filename from another step, then passes it to the operating system. If that name is treated as part of a shell instruction instead of plain text, cleanup can run unintended commands. The fix keeps cleanup out of the shell where possible and tightly limits and quotes any filename that must be passed to it.^{[1], [2]}

Core Concepts & Subsystem Terms

ARCGenAI-Generator: Progress DataDirect tool that generates REST connector artifacts from Swagger/OpenAPI input. The affected release is 2.0; Progress identifies 2.1 as fixed.^{[1], [3]}
Swagger/OpenAPI document: Structured API description supplied to the generator. Its schema names and related metadata are external input and must not become shell syntax.^{[1], [4]}
Shell command injection: A data-to-command boundary failure where untrusted input changes the command interpreted by an operating-system shell.^{[1], [4], [5]}
Temporary-file cleanup: The generator workflow’s removal of intermediate files after assembly. The advisory locates the issue in shell-based cleanup instructions.^{[1], [2]}
CWE-78: Improper Neutralization of Special Elements used in an OS Command; assigned to CVE-2026-91140.^[4]

Framework mappings

CWE reference for the weakness described in this guide: CWE-78

Step-by-Step Attack Flow

Step 1

A developer uses ARCGenAI-Generator 2.0

The affected component is Progress DataDirect Autonomous REST Connector GenAI Agents ARCGenAI-Generator version 2.0. A developer invokes it to process a Swagger/OpenAPI document.^{[1], [3]}

Step 2

Document-derived names flow into the workflow

The CVE record identifies a crafted Swagger/OpenAPI document as the trigger and requires a developer to invoke the generator. The public fix commit shows cleanup receiving {fileName} from the orchestrator; the cited sources do not establish that this filename comes from the document.^{[1], [2]}

Step 3

Cleanup instructions reach a shell

The public pre-fix agent instructions used terminal-based temporary-file cleanup and interpolated {fileName} into path expressions. The fix commit identifies that value as received from the orchestrator; the cited sources do not establish that it is document-derived.^[2]

Step 4

The operating system can interpret input as command syntax

A crafted document can cause the cleanup instruction to execute unintended operating-system commands in the developer process context. The CVE record describes command execution on the developer’s machine; it does not publish a specific exploit string or claim that every generator run is vulnerable.^{[1], [4], [5]}

Step 5

Version 2.1 reduces the shell boundary

The patch prefers native file-editing deletion, requires the filename to match ^[A-Za-z0-9._-]+$, and quotes every filename expansion if a shell fallback is necessary. Progress identifies 2.1 as the fixed version.^{[2], [3]}

Source Code: Flaw vs. Secure Implementation

The vulnerable panel excerpts Progress’s pre-fix agent instructions. The fixed panel summarizes the instruction changes in commit 7ede6d9: prefer native file operations, validate names against the allowlist, and quote every expansion if shell fallback is necessary. It omits executable cleanup commands and exploit input.^[2]

UNPATCHED FLAW

# Before the Progress fix: agent instructions for temporary-file cleanup
After successful assembly, delete temp files using the terminal with shell-native commands.
Use retry logic to handle transient file locks.

HARDENED SECURE PATCH

# Progress fix: use a native file operation where possible
Prefer your file-editing tool's native delete/remove capability over the terminal.
Removing temp files is a plain file-system operation — it does not need a shell.

# If a shell fallback is necessary, validate {fileName} against ^[A-Za-z0-9._-]+$
# and quote every expansion in the platform-specific cleanup instructions.

Engineering & System Hardening Checklist

✓Inventory ARCGenAI-Generator installations, checked-out copies and developer or CI workspaces; confirm the actual product version rather than relying on the parent connector version.^{[1], [3]}
✓Upgrade ARCGenAI-Generator to 2.1 or later. Until upgraded, do not process untrusted Swagger/OpenAPI documents with version 2.0.^{[1], [3]}
✓Review the patched .github/agents/ARCGenAI-Generator.agent.md instructions: native file operations are preferred, {fileName} is allowlisted, and shell expansions are quoted.^[2]
✓FlawOpen guidance: Keep API specifications and schema-derived names untrusted throughout generation, cleanup and validation; do not assume an AI agent will preserve data-command boundaries without explicit controls.
✓FlawOpen guidance: Run developer tools with least privilege and isolate document generation from source repositories, signing material, cloud credentials and production secrets when practical.
✓FlawOpen guidance: Add non-destructive regression tests for filename allowlisting and command-free cleanup selection; use benign names and temporary test fixtures only.
✓FlawOpen guidance: For developer or CI workspaces that ran ARCGenAI-Generator 2.0 on untrusted documents, review available process and file telemetry around those generator runs. Missing telemetry is an assurance gap, not evidence of compromise or safety.

Sources

← AI Security Hub Directory →