Skip to main content

CISA issues advisory on ms-agent command injection

Source Decision Insights Threat Desk Published March 2, 2026 Companies 1
Human View Machine View

39th article in the last 90 days, one of 518 articles referencing Cybersecurity and Infrastructure Security Agency (CISA). Previous coverage: CISA alerts on PyMuPDF path traversal and arbitrary file write (Feb 2026).

Companies mentioned

Best suited for

Seniority
Staff
Job function
Cybersecurity / Information Security
Persona
Security Operations Leader
Buyer role
Technical Implementer / Administrator
Decision stage
Post Buy
Adoption curve
Early Adopters
Industry
Information Technology / Software & Services / IT Services / AI Infrastructure

Our classification, not the publisher's statement. Best suited for, not only for.

ModelScope's MS-Agent framework contains a command injection vulnerability that accepts unsanitized prompt-derived input and can result in arbitrary Operating System (OS) command execution on systems where the framework is deployed.

The issue is recorded as CVE-2026-2256 and involves the framework's Shell tool, which is designed to execute commands on the target OS to complete agentic actions. The Shell tool's check_safe() method uses regular expression–based filtering with a default denylist intended to block unsafe commands, but that denylist can be bypassed. The vulnerability can be triggered when an agent is instructed to process or retrieve external content, including tasks such as analyzing code, summarizing documents, or other actions that involve interacting with attacker-controlled data, allowing crafted prompt-derived input to reach the shell execution layer.

Successful exploitation permits execution of arbitrary OS commands with the privileges of the MS-Agent process. This capability may allow modification of system files, lateral movement within the environment, establishment of persistence mechanisms, or exfiltration of sensitive data accessible to the agent.

No vendor statement was provided during coordination. The advisory states users should deploy MS-Agent only in environments where ingested content is trusted, validated, or sanitized, and that agents with shell execution capabilities should be sandboxed or executed with least-privilege permissions. Additional mitigation strategies listed include replacing denylist-based filtering with strict allowlists and implementing stronger isolation boundaries for tool execution.

The report credits Itamar Yochpaz as the reporter and lists Christopher Cullen as the document author; the advisory also includes references to external resources and notes options for contact and for vendors to provide a statement regarding the vulnerability.

Blog post, originally published by Christopher Cullen at kb.cert.org.

Mentions

Structured data (JSON-LD)

The schema.org markup this page publishes for search engines and AI agents, exactly as they read it.

[
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/#website",
    "@type": "WebSite",
    "name": "Decision Insights",
    "potentialAction": {
      "@type": "SearchAction",
      "target": {
        "@type": "EntryPoint",
        "urlTemplate": "https://decisioninsights.ai/search/?q={search_term_string}&submit=1"
      }
    },
    "publisher": {
      "@id": "https://decisioninsights.ai/#organization"
    },
    "url": "https://decisioninsights.ai"
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/#organization",
    "@type": "Organization",
    "contactPoint": {
      "@type": "ContactPoint",
      "contactType": "customer support",
      "email": "[email protected]"
    },
    "description": "Decision Insights is a Registry of technology companies, open source projects, and industry terms, built for people and for AI agents that need sourced, structured information.",
    "logo": {
      "@type": "ImageObject",
      "url": "https://wiretap-cdn-assets.nyc3.cdn.digitaloceanspaces.com/decision-insights/[email protected]"
    },
    "name": "Decision Insights",
    "parentOrganization": {
      "@type": "Organization",
      "name": "Wiretap Labs",
      "sameAs": [
        "https://www.linkedin.com/company/wiretap-labs",
        "https://www.crunchbase.com/organization/wiretap-labs"
      ],
      "url": "https://wiretaplabs.com"
    },
    "publishingPrinciples": "https://decisioninsights.ai/standards/",
    "sameAs": [
      "https://www.linkedin.com/company/decisioninsights"
    ],
    "url": "https://decisioninsights.ai"
  },
  {
    "@context": "https://schema.org",
    "@type": "BreadcrumbList",
    "itemListElement": [
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai",
        "name": "Decision Insights",
        "position": 1
      },
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai/records/",
        "name": "Records",
        "position": 2
      },
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai/cisa-issues-advisory-on-ms-agent-command-injection/",
        "name": "CISA issues advisory on ms-agent command injection",
        "position": 3
      }
    ]
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/cisa-issues-advisory-on-ms-agent-command-injection/#blogposting",
    "@type": "BlogPosting",
    "about": {
      "@id": "https://decisioninsights.ai/registry/department-of-homeland-security/cybersecurity-and-infrastructure-security-agency-cisa/#organization",
      "@type": "Organization",
      "mainEntityOfPage": "https://decisioninsights.ai/registry/department-of-homeland-security/cybersecurity-and-infrastructure-security-agency-cisa/",
      "name": "Cybersecurity and Infrastructure Security Agency (CISA)"
    },
    "articleSection": [
      "Cybersecurity"
    ],
    "audience": [
      {
        "@type": "Audience",
        "additionalType": "Seniority",
        "audienceType": "Staff"
      },
      {
        "@type": "Audience",
        "additionalType": "Job function",
        "audienceType": "Cybersecurity / Information Security"
      },
      {
        "@type": "Audience",
        "additionalType": "Persona",
        "audienceType": "Security Operations Leader"
      },
      {
        "@type": "Audience",
        "additionalType": "Buyer role",
        "audienceType": "Technical Implementer / Administrator"
      },
      {
        "@type": "Audience",
        "additionalType": "Adoption curve",
        "audienceType": "Early Adopters"
      },
      {
        "@type": "Audience",
        "additionalType": "Industry",
        "audienceType": "Information Technology / Software & Services / IT Services / AI Infrastructure"
      }
    ],
    "author": {
      "@id": "https://decisioninsights.ai/author/decision-insights-threat-desk/#person",
      "@type": "Person",
      "name": "Decision Insights Threat Desk",
      "url": "https://decisioninsights.ai/author/decision-insights-threat-desk/"
    },
    "dateModified": "2026-08-23T13:59:39-06:00",
    "datePublished": "2026-03-02T15:39:03-07:00",
    "description": "MS-Agent command injection: CISA details CVE-2026-2256 and notes crafted prompt input can execute arbitrary OS commands via the Shell tool.",
    "headline": "CISA issues advisory on ms-agent command injection",
    "isBasedOn": {
      "@type": "CreativeWork",
      "author": {
        "@type": "Person",
        "name": "Christopher Cullen"
      },
      "sourceOrganization": {
        "@id": "https://decisioninsights.ai/registry/department-of-homeland-security/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/department-of-homeland-security/",
        "name": "Department of Homeland Security"
      },
      "url": "https://kb.cert.org/vuls/id/431821"
    },
    "keywords": [
      "Operating System",
      "Vulnerabilities"
    ],
    "mainEntityOfPage": {
      "@id": "https://decisioninsights.ai/cisa-issues-advisory-on-ms-agent-command-injection/",
      "@type": "WebPage",
      "sdDatePublished": "2026-08-23",
      "sdPublisher": {
        "@id": "https://decisioninsights.ai/#organization"
      }
    },
    "mentions": [
      {
        "@id": "https://decisioninsights.ai/registry/department-of-homeland-security/cybersecurity-and-infrastructure-security-agency-cisa/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/department-of-homeland-security/cybersecurity-and-infrastructure-security-agency-cisa/",
        "name": "Cybersecurity and Infrastructure Security Agency (CISA)"
      },
      {
        "@id": "https://decisioninsights.ai/projects/modelscope/#project",
        "@type": "SoftwareSourceCode",
        "mainEntityOfPage": "https://decisioninsights.ai/projects/modelscope/",
        "name": "ModelScope"
      }
    ],
    "publisher": {
      "@id": "https://decisioninsights.ai/#organization"
    }
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/author/decision-insights-threat-desk/#person",
    "@type": "Person",
    "description": "CISA advisories, vendor security bulletins, and CVE disclosures, summarized into sourced briefs. Produced under our Standards & Methodology.",
    "name": "Decision Insights Threat Desk",
    "sameAs": [
      "https://www.linkedin.com/showcase/decisioninsights/"
    ],
    "url": "https://decisioninsights.ai/author/decision-insights-threat-desk/"
  }
]

Is this your company? Get structured data for your own pages