When an API Spec Turns Hostile: Progress Patch Details Reveal a Dangerous AI Tooling Blind Spot
A critical command-injection flaw in Progress Software’s early-access ARC model generator shows how a trusted OpenAPI file can become an execution trigger if a tool crosses the line from parsing to shell commands.
Security teams often treat API specs as harmless documentation. CVE-2026-91140 is a reminder that, in the wrong workflow, a spec file can become the payload. Progress Software disclosed a critical command-injection issue in the Early Access Release of its DataDirect Autonomous REST Connector AI Model Generator agents, where a specially crafted OpenAPI or Swagger document can cause the affected agent to run operating system commands.
Fast Facts
- CVE-2026-91140 is classified as a critical command-injection flaw.
- The affected component is the Early Access Release of Progress DataDirect Autonomous REST Connector AI Model Generator agents.
- A malicious OpenAPI or Swagger document can trigger operating system command execution in the vulnerable path.
- Progress has released fixed agent definitions.
- The supplied source material does not report in-the-wild exploitation or customer-data breach.
Conclusion
This case is a sharp example of a modern security truth: the most dangerous file in the room may be the one everyone assumes is only documentation. When a generator turns specifications into action, defenders must protect that conversion step as if it were code execution - because sometimes, it is.
WIKICROOK
- Command injection: A flaw where untrusted input is used to build operating system commands, allowing unintended execution.
- OpenAPI: A machine-readable specification format for describing HTTP APIs.
- Swagger: The older branding and tooling ecosystem associated with OpenAPI.
- CWE-78: The weakness class for improper neutralization of special elements used in an OS command.
- Least privilege: A security principle that limits software and users to only the permissions they need.
