{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-9764",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-09T21:12:48.063108Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-09T21:12:56.521Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:ibm:bob:1.0.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:bob:2.0.1:*:*:*:*:*:*:*"
          ],
          "product": "Bob Shell",
          "vendor": "IBM",
          "versions": [
            {
              "lessThanOrEqual": "2.0.1",
              "status": "affected",
              "version": "1.0.4",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIBM Bob 1.0.4 through 2.0.1 could allow a remote attacker to inject arbitrary code on the system, due to the improper control of user input code.\u003c/p\u003e"
            }
          ],
          "value": "IBM Bob 1.0.4 through 2.0.1 could allow a remote attacker to inject arbitrary code on the system, due to the improper control of user input code."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-08T18:49:02.573Z",
        "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
        "shortName": "ibm"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory",
            "patch"
          ],
          "url": "https://www.ibm.com/support/pages/node/7291535"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIBM strongly recommends addressing the vulnerability now by upgrading to \u003ca href=\"https://bob.ibm.com/docs/shell\" rel=\"nofollow\"\u003eIBM Bob Shell V 2.0.2 or the later\u003c/a\u003e.\u003c/p\u003e\u003cp\u003eWe recommend reviewing the documentation for guidance on installing\u00a0\u003ca href=\"https://bob.ibm.com/docs/ide/getting-started/install\" rel=\"nofollow\"\u003eIBM Bob\u003c/a\u003e.\u003c/p\u003e"
            }
          ],
          "value": "IBM strongly recommends addressing the vulnerability now by upgrading to  IBM Bob Shell V 2.0.2 or the later https://bob.ibm.com/docs/shell .\n\n\n\nWe recommend reviewing the documentation for guidance on installing\u00a0 IBM Bob https://bob.ibm.com/docs/ide/getting-started/install ."
        }
      ],
      "title": "IBM Bob is vulnerable to Remote Code Execution due to improper control of workspace-defined MCP server execution",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cdiv\u003e\u003cp\u003eUntil an upgrade can be applied, IBM recommends the following precautions:\u003c/p\u003e\u003cdiv\u003eOnly use IBM Bob Shell with trusted repositories and trusted code sources.\u003c/div\u003e\u003cdiv\u003eAvoid opening repositories obtained from unknown or untrusted parties.\u003c/div\u003e\u003cdiv\u003eReview repository contents and configuration before use in shared or public environments.\u003c/div\u003e\u003cdiv\u003eFollow organizational security practices for validating and approving source code repositories.\u003c/div\u003e\u003cdiv\u003e\u003c/div\u003e\u003cdiv\u003e\u003cdiv\u003eNote: These mitigations reduce exposure but do not fully address the vulnerability. IBM recommends upgrading to IBM Bob Shell version 2.0.2 or later as the preferred remediation.\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e"
            }
          ],
          "value": "Until an upgrade can be applied, IBM recommends the following precautions:\n\nOnly use IBM Bob Shell with trusted repositories and trusted code sources.\n\nAvoid opening repositories obtained from unknown or untrusted parties.\n\nReview repository contents and configuration before use in shared or public environments.\n\nFollow organizational security practices for validating and approving source code repositories.\n\n\n\nNote: These mitigations reduce exposure but do not fully address the vulnerability. IBM recommends upgrading to IBM Bob Shell version 2.0.2 or later as the preferred remediation."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
    "assignerShortName": "ibm",
    "cveId": "CVE-2026-9764",
    "datePublished": "2026-11-08T18:48:35.920Z",
    "dateReserved": "2026-05-27T18:55:55.317Z",
    "dateUpdated": "2026-11-09T21:12:56.521Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}