CVE-2026-105135 – Unauthenticated Remote Code Execution – InternLM MindSearch 0.1.0

Summary

CVE-2026-105135 is a critical code injection vulnerability in InternLM MindSearch version 0.1.0, affecting the ExecutionAction.run function in the Planner Agent component (mindsearch/agent/graph.py). Manipulation of input arguments allows an attacker to inject and execute arbitrary code, and the flaw can be triggered remotely over the network with no authentication or user interaction required. The vulnerability carries the maximum CVSS v3.1 base score of 10.0 (Critical).

Technical details

• Root cause: The Planner Agent’s ExecutionAction.run function executes model-generated Python code without adequate validation or sandboxing. Publicly documented proof-of-concept analysis of MindSearch deployments shows the backend extracting the first markdown code fence from an LLM response and running it via exec() with full process globals() and builtins, rather than parsing a scoped, validated action payload.
• Trigger conditions: An attacker submits a crafted prompt/request that causes the orchestrated LLM to emit attacker-controlled Python code; MindSearch’s agent graph then executes this code as part of normal query handling.
• Attack vector: Network — the vulnerable /solve endpoint is commonly deployed bound to 0.0.0.0 with no authentication, API key, or session gate, allowing unauthenticated remote attackers to reach the vulnerable code path directly.
• Impact: Full compromise of confidentiality, integrity, and availability. Code executes in the context of the MindSearch process, which in documented deployments runs as root inside the service container, giving an attacker complete control of the host/container running the affected service.

Affected software

• InternLM MindSearch — version 0.1.0 (Planner Agent component, mindsearch/agent/graph.py)

Severity

• CVSS v3.1 Base Score: 10.0 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Mitigation and recommended actions

• Immediate: No vendor-supplied patched version has been confirmed as of this writing; the vendor did not respond to disclosure. Organizations running MindSearch 0.1.0 should check the InternLM/MindSearch GitHub repository for updates addressing this issue and upgrade as soon as a fix is released.
• If no patch is available:
  • Do not expose the MindSearch /solve endpoint (default port 8002) directly to the internet; bind it to 127.0.0.1 or restrict access to trusted internal networks only.
  • Place the service behind authentication (API key, session, or reverse-proxy enforced auth) since the application itself provides none.
  • Run the MindSearch service as an unprivileged, non-root user inside an isolated, ephemeral container with restricted capabilities to limit the blast radius of any code execution.
  • Replace or wrap unsandboxed exec()-based code execution with a restricted, allowlisted operation dispatcher, and ensure only the intended interpreter action payload (not arbitrary content from the LLM response) is parsed and executed.
  • Monitor for unexpected outbound connections, unauthorized file writes, or anomalous process spawning from hosts running MindSearch.

References

• CVE-2026-105135 Record (CVEProject/cvelistV5)
• InternLM/MindSearch GitHub Repository