Monthly
A single crafted HTTP/2 HEADERS block can abort an Apache bRPC process (versions through 1.17.0) that serves h2 or gRPC traffic from an untrusted network, giving remote attackers a repeatable, low-cost denial of service. The h2 parser runs on every bRPC server port and decodes HPACK header blocks before any Authenticator check, so no credentials are required (PR:N per the assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H vector, availability impact only). The input contained no CISA KEV entry, no EPSS score, and no public exploit code, so there is no public exploit identified at time of analysis and active exploitation is not confirmed; the fix ships in Apache bRPC 1.18.0, which bundles 35 security fixes.
Integrity bypass in adm-zip through 0.6.0 allows an unauthenticated attacker who supplies a crafted ZIP to a validate-then-extract application to have getEntry() approve one duplicate entry while extractAllTo() writes a different entry's bytes to disk. The flaw is conditional: the consuming application must inspect a named entry's content via getEntry() and then extract the same archive, and the archive must contain duplicate entry names with the relevant ordering; applications that only extract without a getEntry-based content check are not affected. Public proof-of-concept code is present in the upstream advisory, and no CISA KEV active-exploitation listing is associated with this CVE.
Authentication, authorization, and rate-limiting middleware bypass in @fastify/middie 9.0.0 through 9.3.5 can let a single unauthenticated remote request reach a route handler while path-scoped middleware registered with use() is silently skipped. The flaw occurs when the middleware mount path joined to the plugin scope prefix diverges from the path Fastify's router serves, particularly when the scope prefix ends in a slash, when array mount paths are used, or when mount paths lack a leading slash. Risk is configuration-dependent: applications that rely on path-scoped middie middleware for security and use those mount-path patterns are exposed, while applications enforcing authorization in a post-routing Fastify hook are not; no public exploit identified at time of analysis, and the vendor patch is 9.3.6.
Canonicalization inconsistency in the NGINX JavaScript (njs) XML module lets an unauthenticated attacker who already holds a genuinely signed SAML/XML document cause entity-backed attributes to appear absent or truncated ($attr$Name returning undefined, $attrs derived from only the first attribute child) while signature verification still succeeds. nginx-saml running the built-in njs backend is the confirmed affected consumer, where this can bypass expiry, Destination, and request-correlation checks and enable replay or acceptance of a response outside its intended context; the flaw cannot forge signatures or identities and has no availability or control-plane impact. F5's advisory rates this 8.3 (High, CVSS 4.0 with AT:P reflecting the significant effort needed to obtain a validly signed document); no public exploit code was identified at time of analysis, and no KEV listing applies. There is no public exploit identified at time of analysis.
Command-approval bypass in Roo Code through 3.54.0 lets attacker-influenced input cause the agent to execute arbitrary shell commands without the normal user confirmation prompt. The flaw lives in parseCommandLine(), which validates only the first token of a command against the auto-approval allowlist, so a payload such as $(echo touch /tmp/x) placed in command position passes the echo allowlist check while the shell substitutes and runs the embedded command. Exploitation is unauthenticated in the sense that no Roo Code credentials are required (CVSS 4.0 PR:N), but it depends on attack requirements and passive user interaction (AT:P/UI:P): the victim must run a vulnerable build with command auto-approval enabled and at least one allowlisted command, and must direct the agent at attacker-controlled content (web pages, repository files, issues or dependency docs) that carries an indirect prompt injection. Vendor CVSS 4.0 base is 7.7 (High) with full confidentiality, integrity and availability impact on the local host; no scope change to downstream systems, and no public exploit identified at time of analysis - no confirmed actively exploited (CISA KEV) status was reported. The independent assessment rates the flaw CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H, emphasizing that the non-default auto-approval/allowlist configuration and the need for the developer to actively operate the agent on hostile content are the primary constraints on real-world exposure.
Command approval bypass in Roo Code through 3.54.0 allows unauthenticated remote attackers to execute shell commands that the user or policy has denied, using indirect prompt injection to hide a denied command inside an allowlisted command such as echo. Exploitation is constrained: the host must use bash 5.3+ or ksh93 for the ${ command; } function-substitution syntax to be misread by parseCommandLine(), and Roo Code's auto-approve feature must already permit at least one command that can carry the injected payload. No CISA KEV listing and no public exploit identified at time of analysis; this is a context-dependent moderate-to-high priority issue rather than a mass-exploitation emergency, and it requires user interaction with attacker-controlled content.
Command approval bypass in Roo Code through 3.54.0 lets an attacker get denied shell commands auto-approved and executed by the AI coding agent, defeating the allowlist/auto-approve safety control. The flaw lives in parseCommandLine(), where a quote-masking regex can be desynchronized using escaped or single-quoted double quotes so that command separators are hidden behind an allowlisted prefix such as echo; because the agent's auto-approval logic sees only the benign prefix, it runs the trailing command without user confirmation. It is unauthenticated (CVSS PR:N) but requires the victim to have the auto-approve allowlist enabled with permissive prefixes and to run the agent over attacker-controlled content (indirect prompt injection, e.g. a malicious file, repo, issue, or fetched page), so exploitation is conditional rather than remotely triggerable at will; no public exploit code was identified at time of analysis, and the issue is not confirmed actively exploited (CISA KEV). Vendor patch status: no vendor-released patch identified at time of analysis.
Roo Code through 3.54.0 can execute shell commands that its command auto-approval allowlist is meant to deny, because getCommandDecision() misinterprets a command prefixed with a bare >& redirect and matches the redirect target such as echo instead of the actual denied command. An attacker who can deliver malicious content to the coding agent via indirect prompt injection can bypass the allowlist when a developer runs the agent with auto-approval enabled, gaining full confidentiality, integrity and availability impact on the developer’s machine; exploitation is gated by the need for an indirect prompt injection and active user interaction, and no public exploit was identified at time of analysis. The issue affects versions at or below 3.54.0 and is addressed in versions after 3.54.0, with the supplied CVSS 4.0 vector scoring 7.7 High.
Command permission gate bypass in Mistral Vibe before 2.25.4 lets input processed by the agent cause arbitrary shell command execution with the privileges of the agent's terminal session, while the allowlist gate reports that only a trailing, allowlisted command was run. The bypass hides a command substitution inside a single-quoted variable value that the agent's tree-sitter-bash static parser cannot see, then triggers execution at runtime through bash's ${var@P} prompt-transform operator; the vendor has fixed the misclassification in 2.25.4. Exploitation is conditional rather than opportunistic - an operator must be running an agent session over attacker-controlled content (prompt injection in untrusted files, repositories, web content, or tool output) and a bash shell with promptvars enabled must be in use - and no public exploit code and no confirmed active exploitation were identified at time of analysis.
Permission validation bypass in Mistral Vibe versions before 2.25.5 allows an attacker who can get crafted text in front of the agent to have arbitrary shell commands executed under the user's own privileges, despite the tool's command allowlist. The flaw is a parser disagreement: tree-sitter-bash truncates a backslash-newline continuation and sees only an allowlisted prefix such as 'cd', while bash joins the lines and runs a materially different command (for example a curl request), so resolve_permission grants ALWAYS for the benign-looking prefix and the hidden command executes. Exploitation requires the allowlist / auto-approval mechanism to be in use and requires the user to direct the agent at malicious input (UI:P per the CVSS 4.0 vector, UI:R in the CVSS 3.1 assessment), so it is not fully autonomous, and no public exploit code or confirmed active exploitation was identified at time of analysis. Vendor-released patch: 2.25.5.
A single crafted HTTP/2 HEADERS block can abort an Apache bRPC process (versions through 1.17.0) that serves h2 or gRPC traffic from an untrusted network, giving remote attackers a repeatable, low-cost denial of service. The h2 parser runs on every bRPC server port and decodes HPACK header blocks before any Authenticator check, so no credentials are required (PR:N per the assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H vector, availability impact only). The input contained no CISA KEV entry, no EPSS score, and no public exploit code, so there is no public exploit identified at time of analysis and active exploitation is not confirmed; the fix ships in Apache bRPC 1.18.0, which bundles 35 security fixes.
Integrity bypass in adm-zip through 0.6.0 allows an unauthenticated attacker who supplies a crafted ZIP to a validate-then-extract application to have getEntry() approve one duplicate entry while extractAllTo() writes a different entry's bytes to disk. The flaw is conditional: the consuming application must inspect a named entry's content via getEntry() and then extract the same archive, and the archive must contain duplicate entry names with the relevant ordering; applications that only extract without a getEntry-based content check are not affected. Public proof-of-concept code is present in the upstream advisory, and no CISA KEV active-exploitation listing is associated with this CVE.
Authentication, authorization, and rate-limiting middleware bypass in @fastify/middie 9.0.0 through 9.3.5 can let a single unauthenticated remote request reach a route handler while path-scoped middleware registered with use() is silently skipped. The flaw occurs when the middleware mount path joined to the plugin scope prefix diverges from the path Fastify's router serves, particularly when the scope prefix ends in a slash, when array mount paths are used, or when mount paths lack a leading slash. Risk is configuration-dependent: applications that rely on path-scoped middie middleware for security and use those mount-path patterns are exposed, while applications enforcing authorization in a post-routing Fastify hook are not; no public exploit identified at time of analysis, and the vendor patch is 9.3.6.
Canonicalization inconsistency in the NGINX JavaScript (njs) XML module lets an unauthenticated attacker who already holds a genuinely signed SAML/XML document cause entity-backed attributes to appear absent or truncated ($attr$Name returning undefined, $attrs derived from only the first attribute child) while signature verification still succeeds. nginx-saml running the built-in njs backend is the confirmed affected consumer, where this can bypass expiry, Destination, and request-correlation checks and enable replay or acceptance of a response outside its intended context; the flaw cannot forge signatures or identities and has no availability or control-plane impact. F5's advisory rates this 8.3 (High, CVSS 4.0 with AT:P reflecting the significant effort needed to obtain a validly signed document); no public exploit code was identified at time of analysis, and no KEV listing applies. There is no public exploit identified at time of analysis.
Command-approval bypass in Roo Code through 3.54.0 lets attacker-influenced input cause the agent to execute arbitrary shell commands without the normal user confirmation prompt. The flaw lives in parseCommandLine(), which validates only the first token of a command against the auto-approval allowlist, so a payload such as $(echo touch /tmp/x) placed in command position passes the echo allowlist check while the shell substitutes and runs the embedded command. Exploitation is unauthenticated in the sense that no Roo Code credentials are required (CVSS 4.0 PR:N), but it depends on attack requirements and passive user interaction (AT:P/UI:P): the victim must run a vulnerable build with command auto-approval enabled and at least one allowlisted command, and must direct the agent at attacker-controlled content (web pages, repository files, issues or dependency docs) that carries an indirect prompt injection. Vendor CVSS 4.0 base is 7.7 (High) with full confidentiality, integrity and availability impact on the local host; no scope change to downstream systems, and no public exploit identified at time of analysis - no confirmed actively exploited (CISA KEV) status was reported. The independent assessment rates the flaw CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H, emphasizing that the non-default auto-approval/allowlist configuration and the need for the developer to actively operate the agent on hostile content are the primary constraints on real-world exposure.
Command approval bypass in Roo Code through 3.54.0 allows unauthenticated remote attackers to execute shell commands that the user or policy has denied, using indirect prompt injection to hide a denied command inside an allowlisted command such as echo. Exploitation is constrained: the host must use bash 5.3+ or ksh93 for the ${ command; } function-substitution syntax to be misread by parseCommandLine(), and Roo Code's auto-approve feature must already permit at least one command that can carry the injected payload. No CISA KEV listing and no public exploit identified at time of analysis; this is a context-dependent moderate-to-high priority issue rather than a mass-exploitation emergency, and it requires user interaction with attacker-controlled content.
Command approval bypass in Roo Code through 3.54.0 lets an attacker get denied shell commands auto-approved and executed by the AI coding agent, defeating the allowlist/auto-approve safety control. The flaw lives in parseCommandLine(), where a quote-masking regex can be desynchronized using escaped or single-quoted double quotes so that command separators are hidden behind an allowlisted prefix such as echo; because the agent's auto-approval logic sees only the benign prefix, it runs the trailing command without user confirmation. It is unauthenticated (CVSS PR:N) but requires the victim to have the auto-approve allowlist enabled with permissive prefixes and to run the agent over attacker-controlled content (indirect prompt injection, e.g. a malicious file, repo, issue, or fetched page), so exploitation is conditional rather than remotely triggerable at will; no public exploit code was identified at time of analysis, and the issue is not confirmed actively exploited (CISA KEV). Vendor patch status: no vendor-released patch identified at time of analysis.
Roo Code through 3.54.0 can execute shell commands that its command auto-approval allowlist is meant to deny, because getCommandDecision() misinterprets a command prefixed with a bare >& redirect and matches the redirect target such as echo instead of the actual denied command. An attacker who can deliver malicious content to the coding agent via indirect prompt injection can bypass the allowlist when a developer runs the agent with auto-approval enabled, gaining full confidentiality, integrity and availability impact on the developer’s machine; exploitation is gated by the need for an indirect prompt injection and active user interaction, and no public exploit was identified at time of analysis. The issue affects versions at or below 3.54.0 and is addressed in versions after 3.54.0, with the supplied CVSS 4.0 vector scoring 7.7 High.
Command permission gate bypass in Mistral Vibe before 2.25.4 lets input processed by the agent cause arbitrary shell command execution with the privileges of the agent's terminal session, while the allowlist gate reports that only a trailing, allowlisted command was run. The bypass hides a command substitution inside a single-quoted variable value that the agent's tree-sitter-bash static parser cannot see, then triggers execution at runtime through bash's ${var@P} prompt-transform operator; the vendor has fixed the misclassification in 2.25.4. Exploitation is conditional rather than opportunistic - an operator must be running an agent session over attacker-controlled content (prompt injection in untrusted files, repositories, web content, or tool output) and a bash shell with promptvars enabled must be in use - and no public exploit code and no confirmed active exploitation were identified at time of analysis.
Permission validation bypass in Mistral Vibe versions before 2.25.5 allows an attacker who can get crafted text in front of the agent to have arbitrary shell commands executed under the user's own privileges, despite the tool's command allowlist. The flaw is a parser disagreement: tree-sitter-bash truncates a backslash-newline continuation and sees only an allowlisted prefix such as 'cd', while bash joins the lines and runs a materially different command (for example a curl request), so resolve_permission grants ALWAYS for the benign-looking prefix and the hidden command executes. Exploitation requires the allowlist / auto-approval mechanism to be in use and requires the user to direct the agent at malicious input (UI:P per the CVSS 4.0 vector, UI:R in the CVSS 3.1 assessment), so it is not fully autonomous, and no public exploit code or confirmed active exploitation was identified at time of analysis. Vendor-released patch: 2.25.5.