What to know
- The Canadian Cyber Centre lists ARCGenAI-Generator versions before 2.1 as affected.
- The CVE description connects crafted API documents with shell-based cleanup.
- The vendor patch adds filename checks and changes file deletion instructions.
The affected workflow accepts API descriptions
The Canadian Centre for Cyber Security issued an October 6 advisory for Progress ARCGenAI-Generator versions before 2.1. The CVE-2026-91140 description, mirrored in an unreviewed GitHub Advisory Database entry, identifies operating system command injection involving a crafted Swagger or OpenAPI document and shell-based temporary file cleanup. The described consequence is command execution on the developer’s computer when the generator is invoked.
Progress’s public patch changes agent and prompt files. It requires entity names and filenames to use an allowlist of letters, numbers, dots, underscores and hyphens. It also prefers native file deletion over terminal cleanup and requires quoted filenames when shell commands are necessary. The sources identify a vulnerable workflow and its remediation; they do not establish that attackers have exploited it in an observed campaign.
Source: Canadian Cyber Centre: Progress advisory AV26-1005 · Progress: ARCGenAI generator security patch · GitHub Advisory Database: CVE-2026-91140 record
Analysis: Data reaches an execution boundary
An API description is usually treated as structured input: operations, parameters, names and schemas. A generator can carry values from that document into new filenames and subsequent cleanup operations. The security boundary becomes consequential when the workflow turns those values into text interpreted by a command shell. Trust in the document’s format does not establish trust in every value it contains.
Teams evaluating the exposure need to locate the actual generator configuration used by developers and automation. Instructions stored in an agent file can remain in a repository after a tool has been updated elsewhere. A remediation review should therefore compare the checked-in templates and prompts with the vendor’s fixed release, rather than relying entirely on the version of an unrelated development environment.
The patch also illustrates a distinction between instructions and enforced controls. Telling an agent to validate a filename helps define intended behavior, but the executing tool should independently constrain inputs and accessible paths. A native file operation with a defined target is easier to restrict than a general shell command assembled from document content. Both the instruction layer and the execution layer deserve review.
Remediation includes workflow verification
A practical response starts with updating affected configurations and checking that local copies no longer contain the vulnerable cleanup pattern. Organizations can review which repositories use the generator, who maintains the instructions and where generated files are written. Build environments should give the workflow access only to the working files and services required for its task.
Verification should use ordinary representative API documents to confirm that generation and cleanup still operate correctly. That check should include entity names containing legitimate punctuation and the behavior when a name is rejected. The goal is to ensure that the fix is present without introducing a silent failure that leads developers to restore older instructions or bypass validation.
Any investigation of possible past misuse needs its own evidence, including process records, unexpected file changes and access to credentials on the host. A vulnerable configuration alone does not prove compromise. The immediate documented action is to address the affected generator workflow and verify the controls around the commands it can execute.
Sources & further reading
- Canadian Cyber Centre: Progress advisory AV26-1005
- Progress: ARCGenAI generator security patch
- GitHub Advisory Database: CVE-2026-91140 record
Factual statements are grounded in the linked material. Interpretation and illustrative examples are Byte Watchr analysis. Vendor claims are identified as claims, rather than independent testing.
The event date records the source announcement or documented operation. The coverage edition groups recent developments and is separate from the publication date. Actual publication is recorded above.
Corrections policy · About this byline
