MindSearch Planner Agent vulnerable to critical code injection

What the CVE record confirms

CVE-2026-105135 identifies a code-injection vulnerability in the Planner Agent of InternLM MindSearch 0.1.0. The public record names ExecutionAction.run in mindsearch/agent/graph.py and says manipulated planner inputs can lead to code injection. It assigns a Critical 10.0 score under both CVSS 4.0 and CVSS 3.1, using a network attack vector and no-privileges-required scoring assumptions. Those scores describe the published assessment. They do not establish that every deployment exposes planner inputs remotely. (CVE record)

Reachability depends on deployment

The current upstream source for ExecutionAction.run extracts code from a planner command and passes it to Python’s exec. This confirms the named execution mechanism in upstream code. The record and source do not establish that every deployment accepts attacker-controlled planner inputs, or that the issue provides direct arbitrary host-shell access.

A remotely reachable deployment that accepts untrusted planner input could be exposed. Treat that as a deployment-specific condition to verify, not proof that every MindSearch installation is reachable.

Reduce exposure while awaiting guidance

The CVE record lists only version 0.1.0 as affected. The project releases page lists v0.1.0 and no corrected release as of this review. Operators running 0.1.0 can temporarily isolate the service or restrict access to planner inputs, run it with minimal privileges, and remove secrets it does not need. These steps reduce reachability or potential impact; they do not patch the code. The public record does not establish whether the issue is being exploited in the wild.