Symlink following in nearai ironclaw up to 0.29.1 allows a local low-privileged user to redirect the write_file built-in tool's output to arbitrary files outside the agent's sandbox directory. The root cause is that the validate_path function in src/tools/builtin/path_utils.rs used metadata resolution that follows symlinks rather than symlink_metadata, permitting a dangling symlink inside the sandbox to pass validation and cause the subsequent write to land on an out-of-sandbox target. No confirmed active exploitation (not in CISA KEV) but a public proof-of-concept is referenced at GitHub issue #4797, and EPSS data was not supplied.
Time-of-check time-of-use race condition in Sipeed PicoClaw up to version 0.2.9 allows locally authenticated low-privilege users to exploit the ExecTool.executeRun function in the Go-based pipeline execution agent, achieving limited confidentiality, integrity, and availability impacts. A publicly available proof-of-concept exists via GitHub issue #3081, though the vendor closed the report as 'not planned,' signaling no intent to patch. No public exploit identified at time of analysis in CISA KEV; the local-only attack vector and low impact ceiling make this a low-priority finding for most environments.
Server-side request forgery in SurrealDB before versions 2.0.5, 2.1.5, and 2.2.2 allows authenticated users to circumvent administrator-configured deny-net network restrictions by exploiting unchecked HTTP redirects in the native http::* query functions. An attacker operates a public HTTP server that issues 301 or 307 redirects to denied internal addresses; SurrealDB follows those redirects without re-validating the destination against the deny-net ACL, and returns the internal response directly to the attacker's query result. No public exploit code has been identified at time of analysis; this issue was discovered by cure53 during a commissioned security audit and penetration test of SurrealDB.
DNS rebinding SSRF bypass in SurrealDB's http::* query functions allows authenticated low-privileged users to reach internal network endpoints that administrators explicitly blocked via the --deny-net flag. The server validates the user-supplied hostname string against the deny list rather than the resolved IP address, so a hostname that resolves to a blocked internal IP passes the check and the outbound request is issued anyway. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified, but the CVSS 4.0 subsequent-system impact is rated High across all three CIA components, reflecting that internal services reached via this SSRF bypass may be completely unauthenticated and expose credentials, metadata, or allow configuration changes.
Command injection in LiuMengxuan04 MiniCode 0.1.0 allows a remote attacker to execute arbitrary OS commands with the victim user's privileges by supplying a malicious project-scoped `.mcp.json` file. The `child_process.spawn` call in `mcp.ts` unconditionally loaded MCP server definitions from project-level `.mcp.json` files, meaning any repository under attacker control - or one to which the attacker contributed - could trigger arbitrary command execution when a developer ran MiniCode inside it. A public proof-of-concept exploit exists; an upstream fix (PR #37) gates project MCP config loading behind an opt-in environment variable but has not yet been merged into a released version.
Stored cross-site scripting in parisneo/lollms (latest) lets any authenticated user weaponize the POST /api/prompts/share endpoint to plant JavaScript in another user's direct-message inbox. The unsanitized prompt_content is persisted to DBDirectMessage.content and later rendered via v-html by MessageContentRenderer, so when the victim opens the DM thread the payload executes in their browser context, enabling actions-as-victim, same-origin data theft, and potential account takeover. No public exploit identified at time of analysis and no EPSS/KEV signal is provided, but the reproduction path is well-documented in the huntr bounty report.
Prototype pollution in CartoDB carto-api-client 0.5.29 exposes applications to object prototype manipulation via the `column` argument of the `addFilter` function in `src/filters.ts`. Authenticated remote attackers can inject arbitrary properties into the JavaScript Object prototype, affecting all runtime objects in the application and enabling limited confidentiality, integrity, and availability impacts as reflected by the CVSS 4.0 score of 5.3. No patch has been released - the vendor has not responded to the responsible disclosure filed via GitHub issue #299 - and no active exploitation or public exploit code has been identified at time of analysis.
Prototype pollution in RobinHerbots Inputmask up to version 5.0.9 allows low-privileged remote attackers to manipulate JavaScript's shared Object.prototype via the internal deep merge helper functions extendDefaults, extendDefinitions, and extendAliases in lib/dependencyLibs/extend.js. Successful exploitation enables injection of arbitrary properties onto the global prototype chain, potentially leading to information disclosure, logic bypass, or application state manipulation within any JavaScript runtime consuming the library with attacker-influenced configuration input. No vendor patch is available as the project has not responded to the responsible disclosure report filed via GitHub issue #2885; no public exploit code or CISA KEV listing has been identified at time of analysis.
Reflected XSS in the Flow Payment WordPress plugin version 3.0.8 allows unauthenticated attackers to execute arbitrary JavaScript in a victim's browser by embedding a payload in the error_message GET parameter of the WooCommerce order cancellation URL. The plugin's cancellation handler in flowpayment-fl.php passes this parameter directly to wc_add_notice() without sanitization or output escaping, rendering attacker-controlled content as HTML in the checkout page. No public exploit code has been identified at time of analysis, but the attack is trivially constructable from the fully disclosed parameter name and code path published in the VulnCheck advisory.
Cross-site request forgery in the W3SC Elementor to Zoho CRM WordPress plugin (all versions through 2.2.0) permits unauthenticated attackers to overwrite the site's Zoho CRM integration credentials - including the configured data center, client ID, client secret, and user email - with attacker-controlled values. Exploitation requires social engineering a logged-in WordPress administrator into clicking a crafted link, after which the attacker can silently redirect the site's CRM submissions to their own Zoho account. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; risk is moderated by the mandatory user-interaction prerequisite.
Local file read via DEFINE ANALYZER in SurrealDB before versions 2.1.5 and 2.2.2 allows authenticated users holding root, namespace, or database-level privileges to point analyzer mappings at arbitrary server-side file paths, leaking file contents constrained to two-column tab-separated format. Discovered and rated Low severity during a cure53 code audit and penetration test, the flaw is a CWE-22 path traversal with no KEV listing and no public exploit identified at time of analysis. The vendor has released patches for both the 2.1.x and 2.2.x branches and introduced a SURREAL_FILE_ALLOWLIST environment variable to restrict permissible file paths.
Resource exhaustion in SurrealDB's embedded JavaScript scripting feature allows authenticated users to deny service by submitting long-running or infinite JavaScript functions that consume server CPU and thread resources without bound. Affected deployments must have explicitly enabled the scripting capability - it is off by default - making this a narrow but real risk in multi-tenant or shared SurrealDB environments where not all authenticated users are fully trusted. No public exploit identified at time of analysis; discovered during a professional code audit and penetration test conducted by cure53, rated Low severity by both cure53 and the vendor.
Path traversal in Halo CMS up to version 2.24.2 allows a remotely authenticated high-privilege user to access files outside the intended backup directory via the Download function of MigrationEndpoint.java in the Files Backup Endpoint. The vulnerability is CWE-22 (Improper Limitation of a Pathname) and carries a low CVSS score of 2.0 due to the PR:H requirement, meaning exploitation is limited to users who already hold administrator-level access. A public proof-of-concept exploit exists per the provided references, though no CISA KEV listing was found at time of analysis.
Symlink following in AstrBot's Filesystem Computer-Use Tool (versions up to 4.25.5) allows a low-privileged local attacker to escape intended directory restrictions and access arbitrary files by manipulating the `_normalize_rw_path` function in `astrbot/core/tools/computer_tools/fs.py`. A proof-of-concept exploit has been publicly disclosed via GitHub Gist, and the vendor did not respond to coordinated disclosure - meaning no patch is confirmed available. No public exploit identified at time of analysis as confirmed active exploitation (not in CISA KEV), but the existence of public POC code lowers the barrier for any attacker who already has local access.