According to CoinMeta, Progress Software disclosed this week that its DataDirect autonomous REST connector ARCGenAI proxy has a severe command injection vulnerability, identified as CVE-2026-91140, with a severity score of 9.6. Attackers can execute arbitrary operating system commands on the developer's machine. The trigger condition is the embedding of a shell meta-character in the file name within a OpenAPI or Swagger document. When developers call the ARCGenAI generator, this tool runs a cleanup routine based on shell on temporary files, and this routine directly uses the file name without sufficient validation or reference. This issue was fixed in version 2.1 of the proxy definition, and so far, no actual cases of exploiting this vulnerability have been confirmed.