What is GHSA-w86g-q6vw-5mw6?

GHSA-w86g-q6vw-5mw6 is a security advisory published by GitHub Security Advisories with Critical severity. An OS command injection vulnerability in the shell-based temporary-file cleanup instructions in...

Which CVE IDs does GHSA-w86g-q6vw-5mw6 cover?

GHSA-w86g-q6vw-5mw6 covers the following CVE IDs: CVE-2026-91140. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-w86g-q6vw-5mw6?

GHSA-w86g-q6vw-5mw6 has a CVSS v3 base score of 9.6, published by GitHub Security Advisories.

GHSA-w86g-q6vw-5mw6CriticalCVSS 9.6

An OS command injection vulnerability in the shell-based temporary-file cleanup instructions in...

Vendor

GitHub Security Advisories

Published

October 6, 2026

Last Modified

October 6, 2026

🔗 CVE IDs covered (1)

CVE-2026-91140 →

📋 Description

An OS command injection vulnerability in the shell-based temporary-file cleanup instructions in Progress Software Autonomous REST Connector GenAI Agents ARCGenAI-Generator version 2.0 allows an attacker who supplies a crafted Swagger/OpenAPI document to execute arbitrary commands on a developer's machine when a user invokes the generator.

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2026-91140
https://github.com/progress/datadirect-arc-ai-model-gen/commit/7ede6d96eb033d647ffdcabf8d8069c098293575
https://community.progress.com/s/article/Progress-DataDirect-Critical-Security-Alert-Bulletin-September-2026-CVE-2026-91140
https://github.com/advisories/GHSA-w86g-q6vw-5mw6