What happened
CVE-2026-67547 / GHSA-h24f-gp4c-8qjm: the skill-execution endpoint validated only that the caller had a valid session, not that they were an admin. A non-admin user could invoke the built-in code_exec skill, which runs user-supplied Python via subprocess.run as the backend user, achieving remote code execution.
Why it matters
In a self-hosted AI agent OS, the code_exec skill is the mechanism for agent autonomy; missing authorization turns it into a remote code execution path for any invited user, giving host shell access to the platform running the agents.
Attack vector
POST /api/skill-exec/{skill_id}/call had no admin role check, so any authenticated non-admin user can call the code_exec skill, which runs arbitrary Python via subprocess.run(["python3", "-c", code]) as the backend process user.
Affected systems
jaylfc/taOS < 1.0.0-beta.23 (POST /api/skill-exec/{skill_id}/call, code_exec skill)
Mitigation
Upgrade to taOS 1.0.0-beta.23+, which requires an admin session or the host local token for skill execution (403 before the skill store is touched) and adds a defense-in-depth check inside _skill_code_exec. Restrict skill-exec to admins; isolate code execution in a sandbox.