Dompdf's chroot validation logic in versions before 3.1.6 can be bypassed by an attacker who controls HTML content rendered into a PDF, allowing files outside the configured chroot directories to be read and embedded in the output. The root cause is a flawed `strpos()` prefix check in `validateLocalUri()` that fails to enforce directory boundaries after `realpath()` strips trailing slashes, enabling sibling directories like `/var/www-admin` to satisfy a chroot configured as `/var/www`. A publicly available proof-of-concept exploit is included in the GitHub Security Advisory GHSA-wvh6-f5jh-8gw4; no active exploitation is recorded in CISA KEV, and upgrading to v3.1.6 fully resolves the issue.
OS command injection in umijs umi's GIT File Helper enables arbitrary shell command execution against developer workstations during project builds. All umi 4.6.x releases through 4.6.63 are affected via the getFileCreateInfo and getFileLastModifyInfo functions in packages/utils/src/getFileGitIno.ts, which invoke child processes with shell: true and pass unsanitized file paths directly to the shell. A public proof-of-concept exploit exists; no confirmed active exploitation (CISA KEV) has been identified, and umi 4.6.64 fully remediates the issue.
SQL injection in itsourcecode Hospital Management System 1.0 exposes the `/prescription.php` endpoint to database manipulation via the unsanitized `editid` parameter, exploitable by remote authenticated users. A public proof-of-concept exploit is available on GitHub, lowering the skill barrier for exploitation. No CISA KEV listing is present; the CVSS 4.0 score of 2.1 reflects low impact across all dimensions, likely constrained by the database user's privileges or the limited data scope accessible through this endpoint.
OS command injection in Syncfusion ej2-javascript-ui-controls through version 33.2.3 allows a local attacker with low-privilege access to execute arbitrary operating system commands via unsanitized input passed to the child_process.exec function referenced in package.json. This is a build-time or script-execution sink, meaning exploitation is most likely during npm script invocation in developer workstations or CI/CD pipelines rather than in end-user browsers. A public proof-of-concept exists (GitHub issue #215); no CISA KEV listing is present, and the CVSS 4.0 score of 4.8 reflects limited real-world impact constrained to the local system.
OS command injection in oclif up to 4.23.16 allows a local attacker who can control the jitPlugins configuration to execute arbitrary shell commands through the JIT Plugin Entry Handler's unsafe use of child_process.exec. The root cause is that plugin names from the oclif.jitPlugins field in package.json are interpolated directly into shell command strings passed to exec(), enabling shell metacharacter injection. A public exploit exists (GitHub issue #2051) and a patch has been released replacing exec() with cross-spawn's argument-array-based spawn().
DNS stub and forward zone resolution in NLnet Labs Unbound 1.13.2 through 1.25.1 is silently bypassed due to an off-by-one error in the default-enabled `harden-below-nxdomain` feature. When a configured stub or forward zone apex is nested two or more labels beneath a DNSSEC-signed public zone and the resolver cache holds a DNSSEC-secure NXDOMAIN for the intermediate label, the guard logic walks one label too far, causing the stub/forward upstream to be permanently shadowed without error. No public exploit has been identified at time of analysis and CVSS 3.7 with AC:H reflects the narrow but realistic conditions common in enterprise private namespace deployments.
Resolution service degradation in NLnet Labs Unbound 1.22.0 through 1.25.1 enables unauthenticated remote attackers to silently drop DNS responses for new clients by exploiting a resource-accounting flaw in the DNS-over-QUIC (DoQ) subsystem. Attackers send DoQ queries for names that trigger upstream resolution and immediately terminate them using QUIC STOP_SENDING, RESET_STREAM, or CONNECTION_CLOSE frames, causing Unbound's internal wait-reply counter to inflate indefinitely without release. When the counter ceiling is reached, new clients querying the same in-flight names receive no response. No public exploit has been identified at time of analysis; exploitation is constrained by non-default DoQ configuration requirements and the need for multiple source IPs.
Ghost domain name cache extension in Unbound DNS resolver 1.16.2 through 1.25.1 allows a network-based adversary who controls a ghost zone to overwrite cached expired parent-side A/AAAA glue records, extending the effective ghost domain window by up to one full cache-max-ttl period beyond expiry. A single crafted A/AAAA client query is sufficient to trigger the overwrite; on resolvers using the non-default harden-referral-path: yes directive, Unbound performs the lookup implicitly with no client query required at all. This is a variant of CVE-2026-40622, which addressed only the NS query path - no public exploit has been identified at time of analysis and no CISA KEV listing exists.
DNS cache poisoning in Unbound 1.6.0 through 1.25.1 allows a remote, unauthenticated attacker to inject a falsely DNSSEC-secure wildcard record into the resolver cache by exploiting a race condition on the serve-expired code path. The flaw arises because wildcard RRSET entries can be briefly marked secure after RRSIG validation but before NSEC validation completes, and a concurrent serve-expired thread can capture and propagate that intermediate secure status before it is corrected to bogus. No public exploit has been identified at time of analysis and CISA KEV does not list this vulnerability, but the integrity impact on DNSSEC-relying downstream clients makes it notable for operators running serve-expired in recursive resolver deployments.
DNS Cookie bypass in NLnet Labs Unbound 1.18.0 through 1.25.1 allows an off-path network attacker to defeat RFC 7873 DNS Cookie spoofing protections when Unbound is simultaneously configured with proxy-protocol-port and answer-cookie: yes. The RFC 9018 server-cookie SipHash is computed over the proxy node's wire-layer IP address rather than the PROXYv2-declared client address, meaning a single valid cookie harvested through any proxy node is reusable against every spoofed source behind that node. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; however, the conceptual attack path is straightforward for any attacker with the ability to send one legitimate DNS query through the affected proxy infrastructure.
Insecure credential storage in the Ansible Lightspeed VS Code extension exposes Google Gemini API keys to any local actor operating at user privilege level. The extension writes API keys in plaintext to both user configuration files and extension output log channels, making them readable by co-users of the workstation, other OS-level processes, or malware executing under the victim's account. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified; the primary real-world risk is API credential theft leading to unauthorized quota consumption or service abuse.
Policy bypass in NLnet Labs Unbound 1.6.0 through 1.25.1 causes DNS queries for default-protected zones - including RFC 1918 reverse zones, AS112 zones, .onion, and .localhost - to escape to public recursive resolvers instead of being answered locally. The root cause is that the unbound-control commands view_local_data and view_local_datas, when issued against a named view that was initially configured with no local data, create a bare local zones tree that omits the expected default-protected zone entries. Clients mapped to that view subsequently receive answers from the public internet for names that are supposed to be handled locally, silently subverting operator-defined DNS policy. No public exploit has been identified at time of analysis, and active exploitation has not been confirmed by CISA KEV.
File existence oracle in Dompdf allows remote unauthenticated attackers to enumerate sensitive server-side files by exploiting a behavioral discrepancy in CSS @font-face processing. Crafted HTML containing thousands of @font-face declarations referencing local paths via the file:// protocol causes PHP memory exhaustion only when the target file exists, producing a detectable crash signal versus a clean render for non-existent files. Publicly available exploit code exists (detailed in the GHSA advisory); no KEV listing at time of analysis, but exploitation requires only a public HTTP endpoint that passes unsanitized HTML to Dompdf. A vendor-released patch (v3.1.6) is available.
MongoDB's cursor termination authorization logic fails to scope privileges to the correct database namespace, allowing an authenticated low-privilege user to terminate active cursors on databases they do not administer. Exploitation requires the attacker to hold cursor termination rights on at least one database, limiting the practical threat to malicious or compromised internal users. No public exploit has been identified at time of analysis, and this vulnerability has not been added to the CISA Known Exploited Vulnerabilities catalog.
Heap-based buffer overflow in GNU diffutils' diff3 tool, triggered by signed integer overflows in internal line-mapping arithmetic, enables crash and potential code execution when diff3 processes crafted diff output. Affected is the diff3 binary across diffutils versions tracked under CPE cpe:2.3:a:gnu:diffutils:*:*:*:*:*:*:*:*, where an attacker controlling the diff program invoked by diff3 (e.g., via the --diff-program option pointing to a malicious script) can induce miscalculated memory allocations followed by out-of-bounds writes. No public exploit identified at time of analysis and no CISA KEV listing; a fix is available via upstream commits reported by CERT-PL.
OS command injection in jsforce's SFDX Connection Registry component allows local low-privilege users to execute arbitrary shell commands by supplying unsanitized input to the `_execCommand` function in `lib/registry/sfdx.js`. All versions from 3.10.0 through 3.10.16 are affected. A public proof-of-concept exploit exists, and no patch has been released as the project maintainer has not responded to the responsible disclosure issue filed at GitHub issue #1805.
Command injection in MiniCode-Python 0.1.0 allows a remote attacker to execute arbitrary OS commands on a developer's machine by embedding malicious MCP server definitions in a project-level `.mcp.json` file that the tool automatically loads via `subprocess.Popen` in `minicode/config.py`. Successful exploitation requires the victim to clone or open an attacker-controlled project and invoke MiniCode-Python within it, making this a developer supply-chain style attack with high complexity and passive user interaction requirements. A public proof-of-concept is confirmed per CVSS 4.0 supplemental metric E:P and the referenced GitHub Gist; the vendor has released version 0.1.0-rc1 to resolve the issue.