CVE-2026-105135 InternLM CVE debrief

Who should care

Defenders responsible for InternLM MindSearch deployments should assess exposure and verify the Planner Agent component for potential code injection vulnerabilities. This includes reviewing system configurations, ensuring proper security controls are in place, and monitoring for suspicious activity. Additionally, security teams and vulnerability management teams should prioritize verifying exposure and assessing potential vulnerabilities in the Planner 0.1

Why it matters

CVE-2026-105135 is a critical vulnerability in InternLM MindSearch 0.1.0 that allows for remote code injection. Defenders should prioritize verifying exposure and assessing the Planner Agent component for potential vulnerabilities.

• Verify exposure of InternLM MindSearch 0.1.0 deployments to code injection
• Assess Planner Agent component for potential vulnerabilities
• Review and update affected systems to prevent exploitation

Technical summary

The vulnerability affects InternLM MindSearch 0.1.0 and allows for remote code injection via the ExecutionAction.run function in mindsearch/agent/graph.py of the Planner Agent component. This issue enables attackers to execute arbitrary code, potentially leading to system compromise. Defenders should prioritize verifying exposure of InternLM MindSearch 0.1.0 deployments and assessing the Planner Agent component for potential code injection vulnerabilities. The CVE record was published on 2026-10-04T07:16:33.693Z and has not been modified since then. The NVD entry is currently Received.

Defensive priority

Defenders should prioritize verifying exposure of InternLM MindSearch 0.1.0 deployments and assessing the Planner Agent component for potential code injection vulnerabilities.

Recommended defensive actions

• Verify exposure of InternLM MindSearch 0.1.0 deployments
• Assess Planner Agent component for potential code injection vulnerabilities
• Review and update affected systems
• Apply vendor patches or updates for InternLM MindSearch 0.1.0
• Monitor for suspicious activity related to code injection
• Perform asset inventory to identify affected systems
• Review change windows for applying patches or mitigations

Evidence notes

The CVE record and NVD detail page provide information on the vulnerability, but the vendor did not respond to early disclosure. Additional details are available from source references, including Vuldb and GitHub.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.