CVE-2026-30311: Ridvay Auto-approval Module remote code execution (CVSS 9.8)

Description

Ridvay Code's command auto-approval module contains a critical OS command injection vulnerability that renders its whitelist security mechanism completely ineffective. The system relies on fragile regular expressions to parse command structures; while it attempts to intercept dangerous operations, it fails to account for standard Shell command substitution Ridvay Code (specifically$(...)and backticks ...). An attacker can construct a command such as git log --grep="$(malicious_command)", forcing Syntx to misidentify it as a safe git operation and automatically approve it. The underlying Shell prioritizes the execution of the malicious code injected within the arguments, resulting in Remote Code Execution without any user interaction.

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionNone

ScopeUnchanged

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Ridvay Auto-approval Module≤ 0.1.1

Remediation

No fixed version is recorded in the NVD data. Check the vendor advisory for the latest guidance.

References

https://github.com/Secsys-FDU/LLM-Tool-Calling-CVEs/issues/8Third Party Advisory
https://ridvay.com/Product

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2026-30311 being actively exploited?

CVE-2026-30311 is not in the CISA KEV catalog. Its EPSS exploit probability is 2.16%.

How severe is CVE-2026-30311?

CVE-2026-30311 has a CVSS 3.1 base score of 9.8, rated critical. EPSS estimates a 2.16% probability of exploitation.

Which products are affected by CVE-2026-30311?

Affected products include Ridvay Auto-approval Module.

How do I fix CVE-2026-30311?

Apply the vendor's patch or advisory guidance, then verify no affected versions remain across your devices.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2026-30311 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo