Plugin4Shell
A zero-click remote code execution (RCE) security vulnerability targeting AI coding agents. It exploits plugin mechanisms or prompt injection techniques to trigger malicious code execution without any user interaction, affecting several mainstream AI coding agent products.
Timeline (last 90 days)
Pin-swap is a supply chain attack technique targeting dependency-locking mechanisms that replaces artifact contents or tampers with hook commands while keeping the version number unchanged.
Plugin4Shell is a security vulnerability described as a zero-click remote code execution (RCE), reportedly affecting the top four ranked programming Agents.
Currently publicly available raw information about Plugin4Shell is limited, lacking complete technical disclosure, official confirmation from affected products, and vendor response details.
The name Plugin4Shell evokes the earlier Log4Shell vulnerability, suggesting a possible connection to plugin loading mechanisms or injection chains.
All Facts (2)
Pin-swap is a supply chain attack technique targeting dependency-locking mechanisms that replaces artifact contents or tampers with hook commands while keeping the version number unchanged.
50%UnverifiedThe name Plugin4Shell evokes the earlier Log4Shell vulnerability, suggesting a possible connection to plugin loading mechanisms or injection chains.
50%