Monthly
Eval injection in cPanel's Park API (versions 11.138.0.0 and earlier) enables remote authenticated users to execute arbitrary code with root-level privileges on affected hosting servers. The vulnerability, classified under CWE-95 (Eval Injection) and reported via HackerOne, was disclosed alongside a WebPros vendor advisory on August 27, 2026. No public exploit code or CISA KEV listing has been identified at time of analysis, though the direct path to root execution across a widely deployed hosting platform makes this a critical remediation priority.
Authenticated command injection in IBM Langflow OSS 1.0.0 through 1.11.1 lets any logged-in flow user escalate to arbitrary OS command execution under the server process identity. By saving a flow containing a crafted 'type' field and triggering a build of a wrapper flow that references it, the attacker coerces the backend into evaluating attacker-controlled code, defeating the LANGFLOW_ALLOW_CUSTOM_COMPONENTS=false guardrail intended to block custom code execution. The vendor (IBM) reported it and has released a fix; there is no public exploit identified at time of analysis and it is not in CISA KEV.
Unauthenticated remote code execution in SENAITE.CORE (senaite.core) 2.0.0 through 2.6.0 lets any network-reachable attacker run arbitrary Python in the Zope worker process by chaining a missing authorization check with an eval() sink in the JSON API. The anonymous-reachable /@@API/update route calls eval() on attacker-supplied RecordsField/RecordField values before any permission or write check fires, and a public working PoC (tested against the stock senaite/senaite:v2.6.0 Docker image) demonstrates credential-free command execution. Publicly available exploit code exists; the flaw is not listed in CISA KEV, so there is no confirmation of active exploitation.
Remote code execution in Google langfun before 0.1.2 arises because the default lf.query Python protocol evaluates model-generated Python expressions with no sandbox, letting remote unauthenticated attackers run arbitrary code in the host application by supplying crafted prompt inputs that steer the model into emitting executable code. Because langfun embeds directly in LLM-driven Python applications, any deployment that pipes untrusted prompt content through lf.query is exposed. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the CVSS 4.0 base score of 9.2 (CRITICAL) reflects full confidentiality, integrity, and availability impact.
Eval injection in chirpmyradio CHIRP's Kenwood ITM driver allows arbitrary Python code execution when a user opens a specially crafted CSV file. The vulnerable `_clean_tmode` function in `drivers/kenwood_itm.py` passes untrusted TXSIG and RXSIG CSV column values directly to Python's built-in `eval()` without sanitization, confirmed by the upstream commit diff. A proof-of-concept repository exists publicly, though no active exploitation is confirmed in CISA KEV. All CHIRP builds prior to commit 39178dbfc4fece083ab9ed20286d6ae3a91a718e are affected.
Remote code execution in Xorbits Inference (Xinference) 2.5.0 and earlier lets a remote attacker run arbitrary OS commands in the server process by abusing an unsafe eval() in the Llama3 tool-call parser. Any request to the OpenAI-compatible /v1/chat/completions endpoint with a tools field triggers evaluation of model-generated Python, so an attacker who steers the model's output via a crafted prompt achieves full server compromise; because authentication is disabled in the default deployment, the vendor advisory rates this exploitable by an unauthenticated remote attacker. This is fixed in 2.7.0; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Code injection in the AWS Athena Federated Query Neptune connector (versions 2024.15.1 through 2026.28.1) allows a low-privileged user with query access to Neptune via Athena to reach into and read properties of the AWS Lambda function that provides the connector's compute. Because Lambda environment properties commonly hold configuration and credential material, this exposes the underlying execution context to an authenticated attacker. No public exploit identified at time of analysis; the flaw was reported internally by Amazon (AMZN) and carries a CVSS 4.0 base score of 9.4.
Arbitrary code execution in @cgauge/yaml (all versions ≤ 0.27.0) is achieved by embedding a custom `!js` YAML tag in a document supplied to the parser; the library's tag handler unconditionally passes the tag's string value to `eval()`, granting attackers the full authority of the Node.js runtime - including filesystem access, environment variable exfiltration, network calls, and subprocess spawning. No safe-mode parsing option or opt-out mechanism exists in the library, meaning every call site that parses attacker-controlled YAML is unconditionally vulnerable. A public proof-of-concept exploit is available via GitHub Gist, and no vendor-released patch has been identified at time of analysis.
Arbitrary Python code execution in FreeCAD's BIM module (versions 0.19 through pre-1.1.1) is triggered when a user opens a malicious project template file through the BIM Project Manager's Load Template function. The loadTemplate() method in BimProjectManager.py passes FCStd metadata fields (wpposition, wpu, wpv, wpaxis) directly to Python's built-in eval(), enabling an attacker who can deliver a crafted template to achieve full code execution under the victim's user account. No public exploit has been identified at time of analysis; the vendor-released patch is confirmed in version 1.1.1.
Arbitrary Python code execution in FreeCAD's BIM Workbench (versions 0.19 through 1.1.0) is triggered when a user creates a TechDraw page from a malicious SVG template, due to an unsafe eval() call in BimTDPage.py at line 87. Exploitation requires social engineering - an attacker must deliver a crafted SVG template to a victim who then performs the TechDraw page creation action. No public exploit has been identified at time of analysis and no CISA KEV listing exists, but the vulnerability is structurally trivial (direct eval of attacker-controlled input, CWE-95) and the fix is available in version 1.1.1.
Eval injection in cPanel's Park API (versions 11.138.0.0 and earlier) enables remote authenticated users to execute arbitrary code with root-level privileges on affected hosting servers. The vulnerability, classified under CWE-95 (Eval Injection) and reported via HackerOne, was disclosed alongside a WebPros vendor advisory on August 27, 2026. No public exploit code or CISA KEV listing has been identified at time of analysis, though the direct path to root execution across a widely deployed hosting platform makes this a critical remediation priority.
Authenticated command injection in IBM Langflow OSS 1.0.0 through 1.11.1 lets any logged-in flow user escalate to arbitrary OS command execution under the server process identity. By saving a flow containing a crafted 'type' field and triggering a build of a wrapper flow that references it, the attacker coerces the backend into evaluating attacker-controlled code, defeating the LANGFLOW_ALLOW_CUSTOM_COMPONENTS=false guardrail intended to block custom code execution. The vendor (IBM) reported it and has released a fix; there is no public exploit identified at time of analysis and it is not in CISA KEV.
Unauthenticated remote code execution in SENAITE.CORE (senaite.core) 2.0.0 through 2.6.0 lets any network-reachable attacker run arbitrary Python in the Zope worker process by chaining a missing authorization check with an eval() sink in the JSON API. The anonymous-reachable /@@API/update route calls eval() on attacker-supplied RecordsField/RecordField values before any permission or write check fires, and a public working PoC (tested against the stock senaite/senaite:v2.6.0 Docker image) demonstrates credential-free command execution. Publicly available exploit code exists; the flaw is not listed in CISA KEV, so there is no confirmation of active exploitation.
Remote code execution in Google langfun before 0.1.2 arises because the default lf.query Python protocol evaluates model-generated Python expressions with no sandbox, letting remote unauthenticated attackers run arbitrary code in the host application by supplying crafted prompt inputs that steer the model into emitting executable code. Because langfun embeds directly in LLM-driven Python applications, any deployment that pipes untrusted prompt content through lf.query is exposed. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the CVSS 4.0 base score of 9.2 (CRITICAL) reflects full confidentiality, integrity, and availability impact.
Eval injection in chirpmyradio CHIRP's Kenwood ITM driver allows arbitrary Python code execution when a user opens a specially crafted CSV file. The vulnerable `_clean_tmode` function in `drivers/kenwood_itm.py` passes untrusted TXSIG and RXSIG CSV column values directly to Python's built-in `eval()` without sanitization, confirmed by the upstream commit diff. A proof-of-concept repository exists publicly, though no active exploitation is confirmed in CISA KEV. All CHIRP builds prior to commit 39178dbfc4fece083ab9ed20286d6ae3a91a718e are affected.
Remote code execution in Xorbits Inference (Xinference) 2.5.0 and earlier lets a remote attacker run arbitrary OS commands in the server process by abusing an unsafe eval() in the Llama3 tool-call parser. Any request to the OpenAI-compatible /v1/chat/completions endpoint with a tools field triggers evaluation of model-generated Python, so an attacker who steers the model's output via a crafted prompt achieves full server compromise; because authentication is disabled in the default deployment, the vendor advisory rates this exploitable by an unauthenticated remote attacker. This is fixed in 2.7.0; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Code injection in the AWS Athena Federated Query Neptune connector (versions 2024.15.1 through 2026.28.1) allows a low-privileged user with query access to Neptune via Athena to reach into and read properties of the AWS Lambda function that provides the connector's compute. Because Lambda environment properties commonly hold configuration and credential material, this exposes the underlying execution context to an authenticated attacker. No public exploit identified at time of analysis; the flaw was reported internally by Amazon (AMZN) and carries a CVSS 4.0 base score of 9.4.
Arbitrary code execution in @cgauge/yaml (all versions ≤ 0.27.0) is achieved by embedding a custom `!js` YAML tag in a document supplied to the parser; the library's tag handler unconditionally passes the tag's string value to `eval()`, granting attackers the full authority of the Node.js runtime - including filesystem access, environment variable exfiltration, network calls, and subprocess spawning. No safe-mode parsing option or opt-out mechanism exists in the library, meaning every call site that parses attacker-controlled YAML is unconditionally vulnerable. A public proof-of-concept exploit is available via GitHub Gist, and no vendor-released patch has been identified at time of analysis.
Arbitrary Python code execution in FreeCAD's BIM module (versions 0.19 through pre-1.1.1) is triggered when a user opens a malicious project template file through the BIM Project Manager's Load Template function. The loadTemplate() method in BimProjectManager.py passes FCStd metadata fields (wpposition, wpu, wpv, wpaxis) directly to Python's built-in eval(), enabling an attacker who can deliver a crafted template to achieve full code execution under the victim's user account. No public exploit has been identified at time of analysis; the vendor-released patch is confirmed in version 1.1.1.
Arbitrary Python code execution in FreeCAD's BIM Workbench (versions 0.19 through 1.1.0) is triggered when a user creates a TechDraw page from a malicious SVG template, due to an unsafe eval() call in BimTDPage.py at line 87. Exploitation requires social engineering - an attacker must deliver a crafted SVG template to a victim who then performs the TechDraw page creation action. No public exploit has been identified at time of analysis and no CISA KEV listing exists, but the vulnerability is structurally trivial (direct eval of attacker-controlled input, CWE-95) and the fix is available in version 1.1.1.