CVE-2025-68952
📋 TL;DR
Eigent multi-agent Workforce version 0.0.60 contains a 1-click Remote Code Execution vulnerability that allows attackers to execute arbitrary code on affected systems through a single user interaction. This affects all deployments running the vulnerable version. The vulnerability has been patched in version 0.0.61.
💻 Affected Systems
- Eigent multi-agent Workforce
📦 What is this software?
Eigent by Eigent
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing attacker to install malware, steal data, pivot to other systems, or establish persistent access.
Likely Case
Attacker gains control of the Eigent application server, potentially accessing sensitive workforce data and executing commands.
If Mitigated
Limited impact if proper network segmentation and least privilege controls prevent lateral movement.
🎯 Exploit Status
The advisory describes it as '1-click' RCE, suggesting low complexity exploitation requiring user interaction.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.0.61
Vendor Advisory: https://github.com/eigent-ai/eigent/security/advisories/GHSA-pwcx-28p4-rmq4
Restart Required: Yes
Instructions:
1. Stop the Eigent service. 2. Update to version 0.0.61 using your package manager or deployment method. 3. Restart the Eigent service. 4. Verify the update was successful.
🔧 Temporary Workarounds
Disable user interactions
allTemporarily disable interactive features that could trigger the vulnerability
Network isolation
allRestrict network access to Eigent to trusted users only
🧯 If You Can't Patch
- Isolate the Eigent system from internet and restrict internal access
- Implement strict monitoring for unusual process execution or network connections
🔍 How to Verify
Check if Vulnerable:
Check Eigent version: if running version 0.0.60, system is vulnerable.Check Version:
Check Eigent configuration or deployment manifest for version numberVerify Fix Applied:
Confirm version is 0.0.61 or higher after patching.📡 Detection & Monitoring
Log Indicators:
- Unusual process execution from Eigent
- Suspicious command execution in system logs
- Authentication anomalies
Network Indicators:
- Unexpected outbound connections from Eigent server
- Command and control traffic patterns
SIEM Query:
Process creation from eigent.exe OR suspicious command execution from eigent process