CVE-2025-4032

Summary

CVE-2025-4032 is a critical vulnerability affecting inclusionAI AWorld up to the version 8c257626e648d98d793dd9a1a950c2af4dd84c4e. This issue lies in the function subprocess.run/subprocess.Popen of the file AWorld/aworld/virtual_environments/terminals/shell_tool.py, which enables os command injection. An attacker can exploit this vulnerability remotely, with a high level of complexity. The attack requires significant effort, and exploitation is known to be difficult. The exploit for this vulnerability has been disclosed to the public, increasing the risk of it being used maliciously. Unfortunately, no information is available regarding affected or unaffected releases of this product, as it does not utilize versioning.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.