Reference page — cumulative record through Sunday, October 4, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2026-78250

CVE-2026-78250LOW

bytebot-ai bytebot Agent Execution Workflow infinite loop

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   N   N   L    2.1   .0057   45.0     —

AFFECTED
  Product  Versions  Fixed
  bytebot  0.0.1 –   —

TIMELINE
  Aug 24  EXPLOIT PUBLISHED — CVE-2026-78250 (bytebot-ai bytebot). Public exploit reference added.
  Aug 24  Reserved by VulDB
  Aug 24  Published (CNA: VulDB)
  Aug 26  EXPLOIT PUBLISHED — CVE-2026-78250 (bytebot-ai bytebot). Public exploit reference added.

CWE-404, CWE-835 · CNA: VulDB · CVSS v4.0 · 5 references · NVD status: Deferred

Description

A vulnerability was identified in bytebot-ai bytebot 0.0.1. The affected element is an unknown function of the component Agent Execution Workflow. Such manipulation leads to infinite loop. The attack may be performed from remote. The exploit is publicly available and might be used. This vulnerability only affects products that are no longer supported by the maintainer.

Lifecycle

Complete event history — 4 events, chronological
Date	Event	Detail
August 24, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2026-78250 (bytebot-ai bytebot). Public exploit reference added.
August 24, 2026	Reserved	Reserved by VulDB
August 24, 2026	Published	Published (CNA: VulDB)
August 26, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2026-78250 (bytebot-ai bytebot). Public exploit reference added.

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
bytebot-ai	bytebot	—	0.0.1	—

Weaknesses

CWE-404 · CWE-835

References (5)

Authoritative record: CVE-2026-78250 at cve.org

Vendors: bytebot-ai

Weaknesses: CWE-404 · CWE-835

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-78250 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Sunday, October 4, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.