A weakness has been identified in premAI-io premsql up to 0.2.1. Affected is the function eval of the file premsql/agents/baseline/workers/followup.py. This manipulation of the argument result causes code injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2026-5594 is a code injection vulnerability in premAI-io premsql versions up to 0.2.1 affecting the eval function in followup.py, allowing remote code execution through manipulation of the result argument. The vulnerability has public exploits available and the vendor has not responded to disclosure attempts.
يتعلق هذا الضعف بدالة eval في ملف followup.py من مكتبة premAI-io premsql، حيث يمكن للمهاجمين حقن أكواد برمجية ضارة من خلال معالجة وسيط result بطريقة خاصة. يمكن تنفيذ الهجوم عن بعد وتوجد نسخ استغلالية متاحة للعامة.
A code injection flaw exists in premAI-io premsql up to version 0.2.1 in the eval function of premsql/agents/baseline/workers/followup.py, enabling remote code execution via result argument manipulation. Public exploits are available and vendor communication has failed.
Immediately upgrade premAI-io premsql to version 0.2.2 or later. Implement input validation and sanitization for all arguments passed to the eval function. Apply network segmentation to restrict access to affected systems. Monitor for suspicious code execution patterns. Disable or restrict use of the followup.py module until patched.
قم بترقية premAI-io premsql فوراً إلى الإصدار 0.2.2 أو أحدث. طبق التحقق من صحة المدخلات وتنظيفها لجميع الوسائط المرسلة إلى دالة eval. طبق تقسيم الشبكة لتقييد الوصول للأنظمة المتأثرة. راقب أنماط تنفيذ الأكواد المريبة. عطل أو قيد استخدام وحدة followup.py حتى يتم تصحيحها.