One Malicious Spec File, One Shell, and a Critical Command Path

API specifications are supposed to describe software, not steer a machine into running commands. But in AI-assisted tooling, that line can blur fast. In the case of Progress DataDirect’s Autonomous REST Connector AI Model Generator agents, a specially crafted OpenAPI or Swagger document was enough to turn a normal input file into a command-injection path on the host running the affected agent.

Fast Facts

• CVE-2026-91140 is a critical OS command injection flaw tied to Progress DataDirect’s AI Model Generator agents.
• The affected product scope is the Early Access Release of the Autonomous REST Connector workflow.
• Malformed OpenAPI or Swagger content can influence command execution in the environment running the agent.
• The technical picture fits a CWE-78 weakness, where special input reaches an operating-system command path.
• The provided source does not report data theft, breach activity, or widespread exploitation.

How a spec file crosses the trust boundary

The important detail here is not OpenAPI itself. OpenAPI and Swagger are widely used machine-readable formats for describing APIs, and that makes them ideal fuel for generators, validators, and launchers. Once a tool accepts those files as input, it is no longer handling passive documentation. It is parsing instructions that can shape local behavior.

That is why this issue matters. The vulnerability is described as an OS command injection problem in ARCGenAI-Generator 2.0, meaning attacker-controlled content could reach a shell-oriented command path during processing. In practical terms, a poisoned spec does not need to attack a network service directly. It only needs to be processed by the affected generator. From there, the risk depends on where the tool runs: a developer workstation, a build host, or another automated environment could all become the execution target if they ingest the malicious file.

This also explains why command-injection flaws inside tooling can be so deceptive. The vulnerable component may look like a productivity aid, but once it transforms untrusted input into operating-system actions, it inherits the security burden of much more sensitive software. That is especially true when the workflow is designed to be hands-off, because automation can move faster than human review.

For defenders, the lesson is straightforward: treat API specs as hostile until proven otherwise. Restrict who can provide them, isolate the systems that process them, and keep generator tools patched. The technical interpretation indicates that ARCGenAI-Generator 2.0 is affected and that 2.1 or later is the fixed boundary, so version control matters as much as policy.

One more caution is worth keeping in view: the flaw is triggered when an affected generator processes a specially crafted API spec. In practice, that may happen in developer workflows or other automation pipelines, but the exact deployment pattern will vary by environment. The available information supports a risk analysis, not a claim that every instance of the product was exposed in the same way.

Conclusion

This case is a reminder that modern software supply chains do not only consume code. They consume descriptions, manifests, and specs, and those inputs can carry real execution risk. The broader lesson is simple: when a tool turns documentation into action, the documentation itself becomes part of the attack surface.

WIKICROOK

• Command injection: A flaw where attacker-controlled input is passed to an operating-system command.
• OpenAPI: A standard format for describing HTTP APIs in a machine-readable way.
• Swagger: A tooling ecosystem and older name closely associated with OpenAPI specifications.
• CWE-78: The weakness category for improper neutralization of special elements used in an OS command.
• CVE: A public identifier used to track a specific cybersecurity vulnerability.