CVE-2026-5002 is an injection vulnerability (CWE-707, CWE-74) found in the LLM Prompt Handler component of PromtEngineer localGPT, specifically within the _route_using_overviews function, affecting versions up to 4d41c7d1713b16b216d8e062e51a5dd88b20b054. Rated High with a CVSS score of 7.3, this vulnerability allows for remote exploitation without requiring authentication or user interaction, potentially leading to low impacts on confidentiality, integrity, and availability. Although the exploit has been publicly disclosed, there are no known widespread exploit tools (Metasploit, Nuclei, ExploitDB) or evidence of active exploitation, and community discussion remains minimal. The vendor was contacted but did not respond to the disclosure.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
| PromtEngineer | LocalGPT | 4d41c7d1713b16b216d8e062e51a5dd88b20b054CNA affected |
CVSS version used by this source: 4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.