Unpatched MindSearch Flaw Turns InternLM’s Search Planner Into a Remote Code Runner

A CVE record published on October 4, 2026 rates a code-injection flaw in InternLM’s MindSearch as Critical and says there is no fix to install. CVE-2026-105135 was assigned by VulDB as CNA and is mirrored in the GitHub Advisory Database as GHSA-4535-w5r2-pmqp. It covers MindSearch 0.1.0, the open-source multi-agent framework that InternLM describes as an LLM-based web search engine “like Perplexity.ai Pro and SearchGPT.” The record places the flaw in the Planner Agent component, specifically the ExecutionAction.run function in mindsearch/agent/graph.py. It says the attack can start remotely, that an exploit has been disclosed publicly, and that “the vendor was contacted early about this disclosure but did not respond in any way.”

A planner that is built to execute code

MindSearch splits a question into a graph of sub-queries. A planner model writes the plan as Python that builds a search graph, and the framework runs that code to dispatch searcher agents. The repository source shows how literal that step is. ExecutionAction, documented as the “tool used by MindSearch planner to execute graph node query,” pulls a code block out of the model’s text and passes it to Python’s built-in exec() inside the server process. Nothing sits in between: no sandbox and no allowlist of permitted operations.

That design explains why the record’s CWE labels are code injection (CWE-94) and injection (CWE-74), not memory corruption. The framework already runs code the model writes, so a request that steers the planner also steers what gets executed. In the CVE’s description, “manipulation of the argument inputs” is the trigger. inputs is the field that carries the user’s query into the bundled FastAPI service.

The deployment defaults widen the exposure. The bundled server in mindsearch/app.py binds to all network interfaces unless the operator overrides it, accepts cross-origin requests from any site, and puts no authentication on the endpoint that takes queries. Each of those is a reasonable choice for a demo on a laptop. Together, on a host with a reachable address, they let anyone who finds the service send a query that can run code with the server process’s privileges.

Scores, timeline, and missing vendor response

NVD published the record on October 4, 2026 at 07:16 UTC and still marks it Received, so it has not analysed the issue itself. On that listing the CVSS 4.0 score is 9.3 Critical and the CVSS 3.1 score is 10.0, both carried from the VulDB CNA, with exploit maturity marked as a proof of concept. The CNA timeline puts the advisory disclosure on October 3. The record credits a VulDB user, Snkn0w, as the reporter.

Two gaps in the repository matter as much as the score. MindSearch publishes no SECURITY.md, so there is no documented private channel for reports. And the newest commit on the main branch dates to July 2025, which suggests a quick upstream patch is unlikely. The only affected version the record lists is 0.1.0, and it names no fixed release.

Containing an agent that runs model output

With nothing to upgrade to, mitigation is about deployment:

• Take it off open networks. Bind the API to localhost or a private interface and put it behind a proxy that authenticates callers. A MindSearch instance reachable from the internet should be treated as exposed.
• Sandbox the process. Run the backend in a container as a non-root user. Mount no credentials or cloud roles, and allow outbound traffic only to the search and model APIs it actually needs.
• Narrow cross-origin access. Replace the allow-all CORS default with the origins the front end really uses.
• Review history. Check logs for queries from unexpected addresses, and for prompts that read like instructions to the planner rather than search questions. If an instance was publicly reachable, rotate any keys the process could read.

The pattern is wider than one repository. Planner-executor agents, code-interpreter tools, and research assistants that turn model text into running code all share the property that makes MindSearch dangerous: the execution step is intended, so safety depends entirely on who can reach it and what it can touch. Teams that forked or embedded MindSearch’s planner should check that the code path has a sandbox and that the service sits behind authentication, whichever version they run.

Until InternLM responds or a maintained fork ships a guarded executor, CVE-2026-105135 stays open, with no version to install and only network and container controls to rely on.