Incomplete session cleanup in poco-ai/poco-agent up to version 0.5.4 can permanently destroy the host user's ~/.claude directory - including all Claude Code chat history stored under ~/.claude/projects - when the agent runs outside a container environment. The WorkspaceManager._setup_session_persistence method performs an unconditional rmtree followed by a symlink swap on ~/.claude without verifying a container context, and the corresponding cleanup phase can additionally unlink pre-existing ~/.claude symlinks unrelated to poco-agent. A publicly available exploit exists via GitHub issue #131 and PR #132, though the CVSS 4.0 base score of 2.9 reflects high attack complexity and impact limited to low integrity and availability loss with no confidentiality breach.
Prototype pollution in the Mermaid JavaScript diagramming library (npm/mermaid) exposes applications to JavaScript Object prototype manipulation when attacker-controlled data is incorrectly passed to configuration APIs. The `assignWithDepth` deep-merge helper used by `mermaid.initialize`, `mermaidAPI.setConfig`, and `mermaidAPI.updateSiteConfig` fails to sanitize `__proto__` keys, allowing an attacker to corrupt the shared Object prototype if a host application forwards user-supplied input into these configuration entry points - a usage pattern explicitly outside Mermaid's documented API contract. No public exploit has been identified and no CISA KEV listing exists; vendor risk assessment is low due to the non-standard application integration pattern required for exploitation.
Command injection in nearai ironclaw up to version 0.29.1 allows remote attackers with low-privilege authenticated access to bypass the shell command risk classifier by supplying crafted shell metacharacters, quotes, or escape sequences to the classify_command_risk function in src/tools/builtin/shell.rs. The classifier's naive string analysis fails to account for proper shell tokenization, enabling malicious commands to be categorized as safe and subsequently executed by the agent's built-in shell tool. A public proof-of-concept exploit exists (GitHub issue #4862); the vulnerability is not listed in CISA KEV, and all impact dimensions are rated Low, consistent with a sandbox-constrained environment rather than full system compromise.
Traefik's BasicAuth middleware in versions 3.6.11-3.6.24 and 3.7.0-3.7.9 permits an authenticated low-privilege user to forge arbitrary backend identities via a singleflight key collision race condition. By concatenating their known valid password with a retrieved stored bcrypt hash, an attacker crafts a singleflight deduplication key identical to a legitimate in-flight request's key; the middleware returns the legitimate request's successful authentication result to the attacker's request, then propagates the attacker's chosen unconfigured username to the backend as a trusted identity. A fully working proof-of-concept achieving 25-of-25 successful identity forgeries under default bcrypt cost is publicly available in the GitHub security advisory; no CISA KEV listing has been identified at time of analysis.
Symlink escape in openclaw-cn's apply_patch Tool allows authenticated remote attackers on versions up to 0.2.1 to traverse outside the intended sandbox boundary by exploiting a failure in the assertNoSymlinkEscape validation function in src/agents/sandbox-paths.ts. Attackers with low-level access can craft symbolic links within the sandbox that resolve to paths outside it, yielding limited unauthorized read and write access to the underlying filesystem. A public proof-of-concept exploit is documented in GitHub issue #566, and no vendor patch has been released as the project has not responded to disclosure.
Information disclosure in netease-youdao LobsterAI 2026.6.10 exposes sensitive data through manipulation of the MEDIA Path Handler component. The vulnerable function parseMediaTokensFromText in src/renderer/services/artifactParser.ts can be triggered remotely when a user interacts with attacker-controlled content, leaking confidential information such as local file system paths or internal metadata. A publicly available exploit exists via GitHub issue #2176, and the vendor has not responded to coordinated disclosure, leaving no patch available at time of analysis.
Incorrect privilege assignment in cosmicstack-labs mercury-agent (all versions through 1.1.12) allows authenticated remote attackers to bypass shell command permission checks via the run_command Handler. The flaw resides in the PermissionManager.checkShellCommand function within src/capabilities/permissions.ts, where privilege levels are not correctly validated, potentially enabling a low-privileged user to execute shell commands exceeding their authorized scope. A public proof-of-concept exploit exists via GitHub issue #72, and the project maintainer has not responded to responsible disclosure, leaving no vendor-released patch available at time of analysis.
Improper access control in NousResearch hermes-agent up to 0.16.0 allows low-privileged authenticated users to invoke the Memory Toolset even when it has been explicitly disabled by an operator via the `disabled_toolsets` configuration. The root cause is a missing guard in `init_agent()` within `agent/agent_init.py`, which unconditionally injected the Memory Toolset regardless of operator-level restrictions. A public proof-of-concept exploit exists (GitHub issue #48181), and a vendor patch is available via pull request #46185.
Privilege escalation in openclaw-cn (all versions up to 0.2.1) allows a remote attacker with low-level authentication to bypass the `isApprovedElevatedSender` privilege check in the auto-reply module and assume elevated sender permissions. A publicly disclosed proof-of-concept exploit exists on GitHub issue #564, and the project maintainer has not responded to the responsible disclosure report. No CISA KEV listing exists, but the low attack complexity combined with POC availability makes this a credible risk for any active deployment of the affected application.
Incorrect authorization in openclaw-cn 2026.2.5 allows authenticated remote attackers to bypass the Gateway Exec Approval Flow, circumventing the intended control that governs bash command execution through the agent gateway. The flaw resides in src/agents/bash-tools.exec.ts and is classified as CWE-863 (Incorrect Authorization). No public exploit identified at time of analysis is incorrect here - a proof-of-concept is publicly available via GitHub issue #563, though CISA KEV listing is absent, indicating no confirmed mass exploitation at time of analysis.
Improper privilege management in NanoClaw (versions up to 2.0.64) allows authenticated remote attackers to abuse the `handleCreateAgent` function within the agent-to-agent creation module to escalate privileges beyond their authorization level. A public proof-of-concept exploit is available via a GitHub issue report, and the vendor has not responded to the coordinated disclosure, leaving deployments unpatched. No public exploit identified as actively exploited in CISA KEV, but the public POC and absence of a vendor patch materially elevate near-term exploitation risk.
Improper authorization in cosmicstack-labs mercury-agent's delegate_task tool allows a remotely authenticated low-privilege attacker to invoke SubAgent.run operations beyond their permitted scope in all versions through 1.1.12. No vendor patch has been released - the project was notified via issue report but has not responded. A public proof-of-concept exploit exists (GitHub issue #74), lowering the bar for exploitation in any exposed deployment.
Incorrect authorization in cosmicstack-labs mercury-agent through version 1.1.12 allows remote authenticated attackers to bypass access controls via the bg Command Handler. The flaw (CWE-863) resides in Agent.handleBgCommand within src/core/agent.ts, where a present-but-flawed authorization check can be manipulated to execute unauthorized background commands. A proof-of-concept exploit is publicly available via GitHub issue #73; the vendor has not responded to responsible disclosure and no patch exists at time of analysis.
Incorrect authorization in zhayujie CowAgent up to version 2.1.1 allows low-privilege authenticated remote attackers to bypass access controls in the Self-Evolution Review Agent component. The flaw resides in the _select_tools function of agent/evolution/executor.py (CWE-863), where authorization logic is implemented incorrectly, potentially permitting access to tools or agent capabilities outside the caller's intended permission scope. Publicly available exploit code exists (E:P in CVSS 4.0 vector), though active exploitation has not been confirmed by CISA KEV.
Incorrect privilege assignment in NousResearch hermes-agent through 0.16.0 allows authenticated remote users to invoke toolsets that administrators have explicitly disabled via the disabled_toolsets configuration. The flaw resides in get_tool_definitions within agent/agent_init.py, where the disabled_toolsets list was not checked before injecting tool definitions into an agent session, causing disabled tools (e.g., 'memory') to remain fully accessible. No active exploitation is confirmed (not in CISA KEV), but a public proof-of-concept exists via GitHub issue #46171 and an upstream fix is available in PR #46185.
SQL injection in itsourcecode Hospital Management System 1.0 allows authenticated remote attackers to manipulate database queries via the `editid` parameter in /servicetype.php. The vulnerability is a classic CWE-89 unsanitized input passed directly to a SQL query, enabling read and write access to the underlying database. A public proof-of-concept exploit exists (GitHub issue linked in references), raising the practical risk above the low CVSS 4.0 base score of 2.1 - though exploitation is not confirmed in CISA KEV and real-world deployment of this product is limited.
Use-after-free in MZ Automation libiec61850 up to version 1.6.1 allows a local low-privileged attacker to corrupt memory through the URCB (Unbuffered Report Control Block) dataset shadow buffer deletion path. The vulnerability exists in `deleteDataSetValuesShadowBuffer` within `reporting.c`, where the function dereferenced `self->dataSet` to compute its size after that pointer could already have been freed or set to NULL during connection teardown. A publicly available proof-of-concept exists, though no active exploitation has been confirmed via CISA KEV. The fix, released in v1.6.2 (commit 486fd57f), stores buffer size independently and adds semaphore locking to prevent the race.
Cross-organizational secret deletion in WSO2 Identity Server's Secret Type Management REST API allows an administrator with delete permissions to inadvertently remove secrets across all organizations in a multi-tenant deployment. The on-delete cascade logic, triggered when a secret type is deleted, fails to enforce organizational boundaries - a multi-tenancy isolation failure classified as CWE-281 (Improper Preservation of Permissions). Exploitation yields availability and integrity impact across the entire deployment, though it is constrained to high-privilege administrator accounts. No public exploit is identified and this vulnerability is not listed in the CISA KEV catalog.
Rate-limiting in OpenReception's appointment booking software prior to version 1.0.6 is defeated by two compounding weaknesses: a SHA-256 proof-of-work configured at only 16 bits of difficulty (solvable in under 200ms on modern hardware) and a per-binding throttle service whose key is derived entirely from attacker-controlled parameters. Remote unauthenticated attackers can automate high-volume requests to the `/api/tenants/{id}/appointments/bootstrap-challenge` endpoint - rotating fresh `tunnelId` and `clientPublicKey` values each attempt to generate a new throttle namespace - bypassing both controls and flooding the patient appointment booking flow. No public exploit code has been identified at time of analysis, and this vulnerability does not appear in the CISA KEV catalog.
Username enumeration via observable login response discrepancy affects WSO2 Identity Server, WSO2 Identity Server as Key Manager, WSO2 API Manager, WSO2 Open Banking AM, and WSO2 Open Banking IAM when the Multi-Attribute Login feature is enabled. When a valid username is submitted, the server resolves and returns the canonical form of that username; when an invalid username is submitted, the server echoes the raw input unchanged - creating a deterministic, scriptable oracle for account existence. This disclosure path persists regardless of the validate_username configuration setting, meaning a common hardening measure provides no defense. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
GitHub CLI's `gh auth status` command in versions prior to 2.97.0 partially exposed fine-grained personal access tokens and GitHub App tokens in terminal and CI output due to a flawed masking algorithm. The defect used `strings.LastIndexByte` to find the last underscore as the masking boundary - for tokens like `github_pat_APPID_secretbody` or `ghs_APPID_JWT`, this left the middle segment (between the type prefix and the last underscore) visible in plain text. Affected token types include fine-grained PATs (`github_pat_*`), GitHub App installation tokens (`ghs_*`), user access tokens (`ghu_*`), and the Actions `GITHUB_TOKEN`; classic tokens (`gho_*`, `ghp_*`) are not affected. No public exploit is identified at time of analysis.
Local privilege abuse in pardus-domain-joiner (TÜBİTAK BİLGEM Software Technologies Research Institute) before version 0.5.5 exposes Pardus Linux systems to unauthorized resource access through unverified ownership checks (CWE-283). A locally authenticated user with low privileges can trigger a code path where ownership of a resource is not validated before access or privileged operations are permitted, enabling privilege abuse. No public exploit code or active exploitation has been identified; the CVSS score of 3.3 reflects limited real-world impact confined to local sessions on Pardus Linux systems.
Cross-origin data leakage in Google Chrome's Skia graphics library (versions prior to 151.0.7922.109) enables a remote attacker who has already achieved renderer process compromise to extract cross-origin data through a specially crafted HTML page. The vulnerability is classified CWE-457 (Use of Uninitialized Variable) and carries a low CVSS base score of 3.1, reflecting its dependency on a pre-existing renderer compromise as a prerequisite. No public exploit code has been identified at time of analysis, SSVC exploitation status is rated none, and a vendor-released patch is available in Chrome 151.0.7922.109.
Cross-origin data leakage in Google Chrome's GPU process - caused by an integer overflow (CWE-190) - enables a remote attacker who has already achieved renderer process compromise to read data across origin boundaries by delivering a crafted HTML page. All Chrome desktop releases prior to 151.0.7922.109 are affected. No public exploit or CISA KEV listing exists at time of analysis; the chained nature of the attack (requiring a prior renderer compromise) substantially constrains real-world risk despite the broad deployment footprint of Chrome.
Uninitialized memory use in Skia, Chrome's 2D graphics engine, exposes a cross-origin data leak primitive in Google Chrome prior to 151.0.7922.109. Exploitation is constrained to attackers who have already achieved renderer process compromise - making this a second-stage, chained vulnerability rather than a standalone initial-access vector. No public exploit or active exploitation has been identified; SSVC rates this as non-automatable with partial technical impact, consistent with the low CVSS base score of 3.1.
Cross-tenant invite deletion in OpenReception's appointment booking software (prior to 1.0.6) allows an authenticated TENANT_ADMIN to destroy pending onboarding invites belonging to unrelated tenants on the same platform instance. The flaw exists because the invite cleanup query inside `StaffService.deleteStaffMember()` matches only on email address without constraining to the acting tenant's ID, causing any staff deletion to silently cascade-delete matching invites across all tenants. No active exploitation has been identified and no public exploit code exists; the issue is fully remediated in version 1.0.6 via a single ORM predicate addition.
Shortcode allowlist bypass in the Easy Appointments WordPress plugin (≤ 3.12.26) allows authenticated contributors to execute arbitrary registered shortcodes by exploiting a validation flaw in a block-rendering action. The plugin checks only the first tag of a supplied string against an approved shortcode list, but renders the entire string - meaning a contributor can prepend an allowed tag and append any registered shortcode to bypass the restriction entirely. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, and the vendor-assigned CVSS score of 2.7 (Low) reflects constrained scope, though real-world impact depends on the registered shortcode ecosystem of the targeted site.
Passster WordPress plugin before 4.3.7 allows any authenticated Contributor or higher to bypass global password protection and read protected content via the WordPress core REST API without supplying the protection password. When global protection is enabled, the plugin enforces its access controls only on direct front-end page requests, leaving the REST API path unrestricted for users holding the edit_posts capability. No public exploit has been identified at time of analysis; the CVSS score of 2.7 reflects realistic low risk, constrained to sites with untrusted registered contributors.
Open redirect in html_sanitize_ex (Elixir, versions 0.3.1 through 1.5.2) allows remote attackers to force page visitors to navigate to attacker-controlled URLs by injecting `<meta http-equiv="refresh">` elements that the HTML5 scrubber (HtmlSanitizeEx.Scrubber.HTML5) passes through intact into sanitized output. Because a meta refresh acts at document scope rather than fragment scope, it overrides the host page's navigation regardless of where the sanitized fragment is embedded. The CVE description explicitly rules out JavaScript execution - this is a pure redirect primitive - and no public exploit has been identified at time of analysis.
Command injection in MissionSquad mcp-api through version 1.11.8 enables remote authenticated users to execute arbitrary OS-level commands on the host by supplying a crafted version string to the NPM package installation endpoint. The root cause is string interpolation of unvalidated user input into a Node.js `exec()` call, which passes the resulting string through a shell interpreter - making shell metacharacters in the version parameter an effective injection vector. Proof-of-concept exploit code exists (CVSS 4.0 E:P); no active exploitation has been confirmed by CISA KEV. A patched release (v1.11.9) is available.
Insufficient refresh token invalidation in WSO2 Identity Server's user impersonation flow allows a privileged attacker who has already obtained an impersonated access token to silently renew that authorization via the OAuth refresh token grant, sustaining unauthorized access well beyond the intended session lifetime. The integrity impact is two-fold: the attacker continues performing actions on behalf of the legitimate user, and audit logs attribute those actions to the victim identity rather than the true actor, corrupting traceability and compliance posture. No public exploit is identified and exploitation is bounded by high privilege prerequisites (PR:H) and adjacent network access (AV:A), placing realistic risk firmly in insider-threat and compromised-administrator scenarios.
html_sanitize_ex's HTML5 scrubber (versions 0.3.1 through before 1.5.3) passes attacker-controlled URIs through the `data` attribute of `<object>` elements after a trivially bypassed case-sensitive prefix check, allowing remote attackers to embed arbitrary external or same-origin documents into sanitized pages viewed by victims. The `<object>` tag was never registered through the library's `allow_tag_with_uri_attributes/3` URI-validation mechanism, and its sole guard - a literal lowercase `javascript:` prefix match - is defeated by mixed-case variants, `data:` URIs, protocol-relative URLs, and same-origin relative paths. No public exploit has been identified at time of analysis, and no active exploitation (CISA KEV) has been confirmed; the CVSS 4.0 score of 2.3 correctly reflects constrained real-world impact due to browser-enforced origin isolation on embedded `<object>` content.
CSS at-rule injection in html_sanitize_ex (Elixir, versions 0.3.1-1.5.3) allows unauthenticated remote users to embed `@import` directives that survive sanitization and are rendered in other users' browsers. The `HtmlSanitizeEx.Scrubber.CSS.scrub/1` function applied its allowlist exclusively to `property: value` declaration patterns; `@import` at-rules, which are syntactically distinct, were never inspected and passed through verbatim. Three distinct bypass paths existed: bare `@import url(...)`, no-whitespace `@import"url"`, and CSS hex-escaped `@\69 mport`. No public exploit code is identified at time of analysis; a vendor patch is available as version 1.5.4.
Path traversal in MonomythDevelopment la-forge-mcp 1.0.0 enables low-privileged authenticated users to write files outside the server's intended reference directory via the `screenshot_element` MCP tool. The `screenshotElement` function in `src/index.ts` constructed output file paths using unsanitized user-supplied selector or `output_name` arguments, allowing traversal sequences to escape `REF_DIR` entirely. A public proof-of-concept exists (CVSS E:P; referenced in gongyaugugyy/public_exp/issues/12), though no CISA KEV listing has been identified and the overall CVSS 4.0 score of 2.1 reflects the bounded, low-impact nature of this finding.
Server-side request forgery in MissionSquad mcp-api up to version 1.11.9 allows authenticated remote attackers to coerce the server into issuing HTTP requests to arbitrary internal or external destinations via unsanitized OAuth Dynamic Client Registration (DCR) endpoint URLs. The vulnerability exists in the `registrationEndpoint` field of OAuth templates processed by `src/services/dcrClients.ts`, which was passed directly to `fetch()` without scheme validation or SSRF filtering. No public exploit identified at time of analysis, though the CVSS 4.0 supplemental E:P flag indicates proof-of-concept evidence exists. A vendor-released patch is available in v1.11.10.
Business logic enforcement failure in WonderTrader's backtesting engine (versions up to 0.9.9) allows a low-privileged authenticated remote attacker to manipulate the internal limit order book cache through the MatchEngine::update_lob function in src/WtBtCore/MatchEngine.cpp. The flaw enables integrity-affecting manipulation of simulated or processed order book state in violation of expected matching workflow constraints. No vendor patch exists - the vendor did not respond to responsible disclosure - and proof-of-concept exploit code is publicly available (CVSS 4.0 E:P), though real-world risk is substantially bounded by the authentication requirement, low-only integrity impact, and niche deployment footprint.
Sigstore attestation verification in GitHub CLI prior to 2.97.0 can be defeated when an attacker registers a lookalike repository whose name contains dot characters that function as regex wildcards - for example, github/artifact.attestations-workflows matching a matcher intended solely for github/artifact-attestations-workflows. The `gh attestation verify` command in pkg/cmd/attestation/verify/policy.go constructed Certificate Subject Alternative Name (SAN) matchers by interpolating `--signer-repo` and `--signer-workflow` flag values directly into regex patterns without calling regexp.QuoteMeta(), allowing any dot or other metacharacter in a GitHub-permitted name to act as a wildcard. No public exploit has been identified at time of analysis; the CVSS 4.0 AT:P designator confirms exploitation requires the attacker to first position a valid lookalike repository with legitimate Sigstore attestations, making this a targeted rather than opportunistic threat.
SQL injection in itsourcecode Hospital Management System 1.0 exposes the appointment deletion endpoint `/viewappointment.php` to database manipulation by authenticated low-privileged users via the `delid` parameter. The vulnerability allows partial read, write, and availability impact against the underlying database. A proof-of-concept exploit has been publicly published (CVSS 4.0 E:P), lowering the bar for abuse. No public KEV listing or vendor patch has been identified at time of analysis.
SQL injection in itsourcecode Hospital Management System 1.0 exposes the /viewadmin.php endpoint to database manipulation via the unsanitized `delid` parameter. Authenticated low-privileged attackers with network access can craft malicious requests to read, modify, or delete records from the underlying database. A public exploit exists (POC confirmed via VulDB submission); no KEV listing at time of analysis.
SQL injection in itsourcecode Hospital Management System 1.0 allows remote attackers with low-privilege credentials to manipulate database queries via the unsanitized `editid` parameter in `/treatmentrecord.php`. Exploitation can expose or alter sensitive patient treatment records stored in the backend database. A publicly disclosed exploit exists (E:P), though no confirmed active exploitation appears in CISA KEV at time of analysis.
SQL injection in itsourcecode Hospital Management System 1.0 allows authenticated remote attackers to manipulate database queries by supplying crafted input via the `patientid` parameter in `/treatmentdetail.php`. Successful exploitation can result in unauthorized read or modification of patient records and other database contents. Publicly available exploit code exists (CVSS 4.0 supplemental E:P), raising practical risk above the low numeric score of 2.1 suggests; however, no confirmed active exploitation has been identified in CISA KEV at time of analysis.
SQL injection in itsourcecode Hospital Management System 1.0 exposes the `/treatment.php` endpoint to database manipulation via the `editid` parameter, accessible to remote low-privilege authenticated users. Public exploit code has been released and is referenced via a GitHub issue, making exploitation straightforward for attackers who have obtained any valid session. The CVSS 4.0 score of 2.1 reflects bounded impact (low C/I/A, no subsequent-system scope), but the healthcare context - where treatment records carry regulatory and patient-safety weight - elevates real-world consequence beyond the raw score.
Certificate validation bypass in OpenVPN 2.7 alpha series (mbedTLS builds) causes the --x509-username-field directive to unintentionally accept certificates that should be rejected, potentially granting unauthorized VPN network access. Only deployments running a 2.7 alpha or pre-release build compiled against mbedTLS and explicitly configured with --x509-username-field are exposed; OpenVPN 2.6.x stable series and OpenSSL-backend builds are not affected. The vendor characterizes this as a low-priority security finding; no public exploit has been identified at time of analysis and it is not listed in the CISA Known Exploited Vulnerabilities catalog.
Command injection in Kino-Kafkaesque ssh-mcp-server's SSH Command Handler allows a local low-privilege attacker to execute arbitrary commands by manipulating the host or username arguments passed to the ssh_exec function in src/index.ts up to commit 8ebbbb99b26f80ff6162fe00957c6dec73fbc5a5. Proof-of-concept code exists (CVSS E:P), though the maintainer explicitly disputes the severity, stating the tool's intended threat model assumes fully trusted local callers who already possess meaningful shell execution capability via the MCP interface. The actual existence of this vulnerability is formally in question per the CVE description, and no CISA KEV listing is present.
Command injection in LeeSinLiang's godot-mcp 0.1.0 allows local low-privileged users to execute arbitrary OS commands by supplying a crafted projectPath argument to the executeOperation function in src/index.ts, specifically through the create_scene and add_node MCP operation handlers. This Model Context Protocol server for the Godot game engine was disclosed via a GitHub issue report that the project maintainer has not yet addressed. No active exploitation has been confirmed and no CISA KEV listing exists, though the CVSS 4.0 temporal metric E:P confirms publicly available proof-of-concept exploit code.
Command injection in NocteDefensor LudusMCP through version 1.0.24 allows a local attacker with low privileges to execute arbitrary OS commands by supplying crafted input to the `command` or `args` parameters of the `executeArbitraryCommand` and `executeCommand` functions in `src/ludusMCP/cliWrapper.ts`. A proof-of-concept exploit is publicly referenced (CVSS 4.0 E:P; GitHub issue at gongyaugugyy/public_exp), and the vendor has not responded to the coordinated disclosure. No active exploitation has been confirmed via CISA KEV, but the public POC lowers the exploitation barrier for any local attacker on systems running this MCP server.
Command injection in NocteDefensor LudusMCP (all versions through 1.0.24) permits a local low-privileged attacker to execute arbitrary OS commands by manipulating the Description argument passed to SecretDialog.showSecretDialog within the get_credential_from_user component (src/utils/secretDialog.ts). Exploitation is constrained to the local host and requires at minimum low-privilege OS credentials, consistent with the CVSS 4.0 AV:L/PR:L metrics and a final score of 1.9. A proof-of-concept exploit has been publicly posted (CVSS 4.0 E:P; GitHub issue at gongyaugugyy/public_exp), but no vendor patch has been released - the project has not responded to the coordinated disclosure as of this analysis.
Stored cross-site scripting in DataGear up to version 5.0.0 allows a high-privileged authenticated attacker to inject malicious script into dashboard chart titles, which executes in the browser of any user who subsequently views the affected dashboard. The vulnerability resides in HtmlTplDashboardWidgetHtmlRenderer.java within the Chart Name Handler, where the Title argument is rendered without adequate output encoding. A proof-of-concept has been publicly disclosed; the vendor did not respond to pre-disclosure contact, meaning no official patch is confirmed at time of analysis.
Path traversal in MetaGPT versions 0.8.0 through 0.8.2 (FoundationAgents) allows a local low-privileged attacker to read arbitrary files on the host system via the `read` function in `metagpt/tools/libs/editor.py`. Impact is limited to confidentiality - no write or availability impact is present. A public proof-of-concept exploit has been disclosed on GitHub; no vendor patch exists as the vendor did not respond to coordinated disclosure.
Code injection in FoundationAgents MetaGPT versions 0.8.0 through 0.8.2 allows a local attacker with low-privilege credentials to inject and execute arbitrary code within the application's process context. The vulnerability (CWE-74) affects an unspecified function and produces low-severity confidentiality, integrity, and availability impacts with no lateral scope change to other systems. A public exploit is available via GitHub gists linked in the CVE references; no active exploitation has been confirmed by CISA KEV, and the CVSS 4.0 base score of 1.9 reflects the constrained local-only attack surface.