0x4m4 vulnerabilities
We track 5 vulnerabilities in 0x4m4 products. 5 are rated high or critical, and none are known to be exploited. The most recent was published on September 14, 2026.
Latest 0x4m4 vulnerabilities
- 8.3 High severity
HexStrike AI: Improper Limitation of a Pathname to a Restricted Directory
A security vulnerability has been detected in 0x4m4 HexStrike AI up to d689933ff579d839c676c82b231f8e98326c5f04. The impacted element is the function FileOperationsManager of the file hexstrike_server.py of the component API Files Endpoint. The manipulation of
- 7.3 High severity
HexStrike AI: Improper Neutralization of Special Elements used in a Command
A weakness has been identified in 0x4m4 HexStrike AI up to d689933ff579d839c676c82b231f8e98326c5f04. The affected element is the function subprocess.Popen of the file hexstrike_server.py of the component API Tools Endpoint. Executing a manipulation of the argu
- 7.3 High severity
HexStrike AI: Improper Authentication
A vulnerability was determined in 0x4m4 HexStrike AI up to d689933ff579d839c676c82b231f8e98326c5f04. The impacted element is an unknown function of the file hexstrike_server.py of the component API Command Endpoint. This manipulation causes missing authenticat
- 7.3 High severity
HexStrike AI: Improper Neutralization of Special Elements used in a Command
A vulnerability has been found in 0x4m4 HexStrike AI up to d689933ff579d839c676c82b231f8e98326c5f04. Impacted is an unknown function of the file hexstrike_server.py of the component Execute Endpoint. The manipulation of the argument code/script leads to os com
- 9.1 Critical severity
HexStrike AI: Improper Neutralization of Special Elements used in an OS Command
By providing a command-line argument starting with a semi-colon ; to an API endpoint created by the EnhancedCommandExecutor class of the HexStrike AI MCP server, the resultant composed command is executed directly in the context of the MCP server’s normal priv