CVE-2026-8210
MediumCVSS 5.3Exploitation Probability (EPSS)
Elevated risk54th percentile - higher than 54% of all known CVEs
Summary
In aandrew-me tgpt up to version 2.11.1 on Linux/macOS, a command injection vulnerability exists in the helper.Update function of the helper.go file in the Update Handler component. Local access is required, and the exploit has been publicly disclosed.
Risk Assessment
A local attacker can execute arbitrary system commands in the context of the user running tgpt, potentially leading to full system compromise.
Recommendation
Update tgpt to a version newer than 2.11.1 that contains the fix.
Original NVD description (English source)
A security vulnerability has been detected in aandrew-me tgpt up to 2.11.1 on Linux/macOS. Affected by this vulnerability is the function helper.Update of the file helper.go of the component Update Handler. The manipulation leads to command injection. Local access is required to approach this attack. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.