CVE-2026-3964 | OpenAkita up to 1.24.3 Chat API Endpoint shell.py run Message os command injection

A vulnerability classified as critical was found in OpenAkita up to 1.24.3. This impacts the function run of the file src/openakita/tools/shell.py of the component Chat API Endpoint. Executing a manipulation of the argument Message can lead to os command injection.

This vulnerability is tracked as CVE-2026-3964. The attack is restricted to local execution. Moreover, an exploit is present.

The vendor was contacted early about this disclosure but did not respond in any way.