Code Injection
Monthly
Remote code execution in the Fabrik extension for Joomla (all versions 1.0.0 through 4.7.2) allows unauthenticated attackers to run arbitrary PHP through the extension's PHP form element, which evaluates user-supplied code. Rated CVSS 10.0 with a network, no-privileges, no-interaction vector and full confidentiality/integrity/availability impact including scope change, this yields complete compromise of the underlying Joomla host. No public exploit identified at time of analysis, but the triviality of PHP-eval injection makes weaponization straightforward once details circulate.
Arbitrary code injection in the Natural Language Toolkit (NLTK) before 3.9.3 stems from the downloader module extracting downloaded corpora and model packages without verifying their integrity, allowing an attacker positioned to tamper with the download (man-in-the-middle or DNS poisoning) to substitute malicious archive contents that are unpacked onto the victim host. All NLTK versions prior to 3.9.3 are affected (CWE-494). Reported by VulnCheck; a vendor patch exists, but no public exploit has been identified and it is not listed in CISA KEV.
Null byte and CRLF injection in Netty's SOCKS4 and SOCKS5 client encoders (Socks4ClientEncoder, Socks5ClientEncoder) allows an attacker who controls domain address or authentication fields to truncate or alter proxy connection parameters, enabling domain spoofing, userid truncation, authentication data injection, and protocol confusion. Affected are all Netty releases in the 4.1.x branch through 4.1.136.Final and the 4.2.x branch through 4.2.16.Final - both branches have been patched. No public exploit code has been identified at time of analysis and this CVE is not listed in CISA KEV, but the integrity impact on downstream SOCKS proxy routing is concrete.
Unauthenticated shortcode injection in the kk Star Ratings - Rate Post & Collect User Feedbacks WordPress plugin (all versions through 5.4.10.3) allows any remote, unauthenticated attacker to execute arbitrary WordPress shortcodes by supplying a crafted payload to the plugin's AJAX handler. The flaw exists because the wp_ajax_kk-star-ratings action passes a user-controlled 'payload' parameter directly to do_shortcode() without allowlisting or sanitizing which shortcode tags are permitted. No public exploit has been identified at time of analysis and this CVE does not appear in the CISA KEV catalog; however, threat intelligence sources tag this as RCE, indicating that practical impact can escalate significantly depending on what shortcodes co-installed plugins register.
Privilege boundary bypass in the Forminator Forms WordPress plugin (versions 1.40.0 through 1.57.0.5) enables any site-level administrator on a WordPress multisite network to modify a network-wide setting that triggers arbitrary code execution across all sites on the network, effectively allowing lateral escalation from single-site admin to full network compromise. This collapses the critical trust boundary between WordPress multisite's site administrator and network (super) administrator roles. No public exploit or CISA KEV listing exists at time of analysis, but the EPSS score of 0.18% (8th percentile) indicates low automated exploitation activity - not low potential impact.
Arbitrary code execution in the JSONata JavaScript library (npm 'jsonata') before 1.8.8 and 2.2.1 lets an attacker who controls a JSONata expression break the engine's object-integrity guarantees and run OS commands on the host. By chaining an overwrite of $clone, deconstruction of internal lambdas via $merge.*, and abuse of proc.arguments.forEach in applyProcedure, a crafted expression reaches process.getBuiltinModule('child_process') and executes code with the privileges of the Node.js process. A complete working proof-of-concept is published in the GitHub advisory; publicly available exploit code exists, though the issue is not listed in CISA KEV and no active exploitation is confirmed.
Arbitrary code execution in the JSONata JSON query/transformation library (npm 'jsonata') lets an attacker who controls a JSONata expression break out of the evaluation context and run OS commands with the host process's privileges. The flaw stems from a bypassable hasOwnProperty check in environment.lookup that permits prototype-chain traversal to reach process.getBuiltinModule('child_process'). A working proof-of-concept is published in the vendor GHSA advisory, and vendor patches (1.8.8 and 2.2.1) are available; no CISA KEV listing has been identified.
Arbitrary code execution in JSONata (npm 'jsonata') versions up to 1.8.7 and 2.0.0-2.1.x allows an attacker who controls a JSONata expression to break out of the query engine and run OS commands via Node's child_process. The flaw stems from the lookup function reaching inherited prototype members (setters/getters, constructor, valueOf) to obtain process.getBuiltinModule and call execSync, executing code with the host process's privileges. Publicly available exploit code exists in the GHSA advisory, and CVSS 4.0 rates it 9.3 (Critical); there is no evidence of active exploitation.
Remote code execution in Xorbits Inference (Xinference) 2.5.0 and earlier lets a remote attacker run arbitrary OS commands in the server process by abusing an unsafe eval() in the Llama3 tool-call parser. Any request to the OpenAI-compatible /v1/chat/completions endpoint with a tools field triggers evaluation of model-generated Python, so an attacker who steers the model's output via a crafted prompt achieves full server compromise; because authentication is disabled in the default deployment, the vendor advisory rates this exploitable by an unauthenticated remote attacker. This is fixed in 2.7.0; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Compile-time PHP code injection in the Phalcon (cphalcon) PHP framework's Volt template compiler (versions 5.15.0 and earlier) lets an attacker who can influence Volt template source achieve remote code execution. The Volt `join` filter emits the separator and array arguments as raw, unescaped bytes into the generated PHP, so quote-breaking content escapes the `join('…')` call and is written into the cached compiled template that is then require()'d at render time. Publicly available exploit code exists (a working PoC that runs shell_exec is published in the GHSA advisory); the issue is not listed in CISA KEV and no active exploitation is confirmed.
Arbitrary code execution in Facebook Research Hydra prior to version 1.3.4 allows any party who can supply untrusted configuration - including YAML config files, CLI overrides, or ML model metadata - to invoke dangerous Python callables through hydra.utils.instantiate(). The vulnerability stems from _resolve_target() accepting any Python callable path without restriction, enabling an attacker to trigger functions such as os.system, subprocess.Popen, or builtins.exec inside the consuming application's process. No public exploit code has been identified at time of analysis, and no CISA KEV listing exists; the upstream fix is confirmed shipped in v1.3.4.
Code injection in the AWS Athena Federated Query Neptune connector (versions 2024.15.1 through 2026.28.1) allows a low-privileged user with query access to Neptune via Athena to reach into and read properties of the AWS Lambda function that provides the connector's compute. Because Lambda environment properties commonly hold configuration and credential material, this exposes the underlying execution context to an authenticated attacker. No public exploit identified at time of analysis; the flaw was reported internally by Amazon (AMZN) and carries a CVSS 4.0 base score of 9.4.
Process-wide Mustache HTML escaping is permanently disabled in Unleash (all versions prior to 8.0.3) from the first moment any notification addon formats a feature event, allowing an editor-level user who has placed Slack or Teams link syntax in their unrestricted username to inject attacker-controlled hyperlinks into every configured outbound notification channel - including Slack, Microsoft Teams, Datadog, New Relic, and email. The scope change (S:C in CVSS) reflects that the vulnerable assignment in FeatureEventFormatterMd contaminates Mustache rendering across email-service.ts, webhook.ts, datadog.ts, and new-relic.ts for the lifetime of the Node.js process. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis.
Remote code execution in Omnigent's multi-tenant runner allows any authenticated user to hijack the runner process by uploading a crafted agent bundle that specifies a dotted Python import path (e.g., subprocess.check_output) as a server-side callable tool. The server's bundle validator failed to inspect the callable field, so the runner blindly imported and executed the specified Python symbol with its own process permissions. All Omnigent deployments prior to version 0.3.0 running in shared or multi-tenant mode are affected; no public exploit has been identified at time of analysis, though the GHSA advisory and fix PR provide a detailed exploitation roadmap.
Remote code execution in Omnigent, an open-source AI agent framework and meta-harness, before version 0.3.0 allows an authenticated user with session edit access to hijack shared/template agents and achieve command execution on the runner host. The PUT /sessions/{session_id}/agent endpoint enforces LEVEL_EDIT on the session but fails to reject a bound shared or template agent (whose agent.session_id is None), letting the attacker replace the shared agent bundle and inject a malicious stdio MCP server that later executes an attacker-controlled command. There is no public exploit identified at time of analysis, but a vendor patch (0.3.0) and the fixing commit are public.
Remote code execution in SPIP CMS versions prior to 4.4.21 lets unauthenticated attackers run arbitrary PHP/OS commands by abusing the template engine's X-Spip-Filtre header handling. A newline injected into a GET parameter forces analyse_resultat_skel() to treat an attacker-supplied header() call as a template filter chain, and a working Metasploit module (intval|_request|system) already achieves full command shell access. The CVE description claims in-the-wild exploitation in August 2026; publicly available exploit code exists, making this a top-priority patch.
Line-protocol injection and log spoofing in Spring Micrometer's StatsD and LoggingMeterRegistry components allow network-reachable attackers to forge arbitrary metrics and log entries by embedding newline characters into user-supplied strings that flow unvalidated into meter names, tag keys, or tag values. Affected deployments span the 1.9.x through 1.17.x release lines of io.micrometer:micrometer-registry-statsd and io.micrometer:micrometer-core when the Datadog or Etsy StatsD flavor is active, or when LoggingMeterRegistry is in use. No public exploit has been identified at time of analysis, though the integrity-focused impact carries real risk for organizations whose incident-response workflows depend on Micrometer-sourced telemetry.
XML injection in joshnuss xml_builder (Elixir) allows an attacker who can influence element names, attribute names, or doctype identifiers to inject arbitrary XML markup - including extra elements, comments, and event-handler attributes - into the serialized document output. All library releases from 0.0.1 through 2.4.0 are affected; the vulnerability resides in the core XmlBuilder.element and XmlBuilder.generate API surface. No active exploitation has been confirmed (CVE is not in CISA KEV), and no standalone public exploit code has been identified, though the GitHub security advisory includes demonstrative test cases.
XML injection in joshnuss xml_builder (versions 0.0.7 through before 2.4.1) enables content spoofing and XML structure manipulation when attacker-controlled data reaches CDATA sections generated by the library. The escape/1 function concatenates CDATA content verbatim without splitting on the ]]> delimiter sequence, allowing premature closure of the CDATA section and injection of arbitrary XML markup into the output document. A vendor patch is available in version 2.4.1; no public exploit code and no CISA KEV listing have been identified.
Argument injection in Apache InLong's Agent Installer (versions 2.0.0 through 2.3.x) enables arbitrary shell command execution via the ModuleManager's ExcuteLinux.exeCmd() method, which applies no input filtering or whitelist validation. Any deployment running InLong agents within the affected version range is exposed to OS-level command execution on the agent host system. Apache has released version 2.4.0 as the authoritative fix; no public exploit has been identified at time of analysis.
Remote code execution via file upload bypass in the Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin (versions before 1.3.9.9) is exploitable by unauthenticated attackers against public-facing WordPress contact forms. The plugin strips certain characters from uploaded filenames as a sanitization step but fails to re-validate the resulting filename against its file type allowlist, enabling an attacker to craft a filename that survives stripping as a server-executable extension (e.g., PHP). A publicly available proof-of-concept exploit exists; a vendor patch is available at version 1.3.9.9 and should be applied immediately given the no-authentication, network-accessible attack surface.
Remote code execution in SPIP before 4.4.20 allows unauthenticated attackers to run arbitrary PHP on the server by exploiting flawed detection of `<?php` blocks combined with var_export's mishandling of input containing a '<' character. The CVE description itself reports exploitation in the wild during August 2026, and the flaw is network-reachable with no authentication or user interaction (CVSS 9.8). This is a CWE-94 code-injection issue affecting all SPIP releases prior to the fixed 4.4.20.
HTTP request smuggling (CL.TE desynchronization) in Cesanta Mongoose embedded web server before 7.22 lets a remote unauthenticated attacker craft a request bearing both Content-Length and Transfer-Encoding: chunked headers. Because mg_http_parse()/http_cb() accept both and prioritize chunked encoding while a front-end reverse proxy that prefers Content-Length draws a different request boundary, an attacker can smuggle a second request that reads or modifies resources belonging to another user's context. No public exploit is identified at time of analysis; the issue is fixed in 7.22 which rejects requests containing both headers.
NoSQL operator injection in LangGraph's MongoDB persistence libraries (langgraph-checkpoint-mongodb < 0.3.0 and langgraph-store-mongodb < 0.4.0) allows authenticated API callers to embed MongoDB query operators directly in filter parameters, bypassing per-tenant query predicates and exposing other tenants' checkpoint and store data. The flaw affects MongoDBSaver.list(), MongoDBSaver.alist(), and MongoDBStore.search() methods whenever filter arguments derive from user-controlled input in multi-tenant deployments. No public exploit or CISA KEV listing exists at time of analysis, but the cross-tenant data exposure is a concrete, high-impact risk for any multi-tenant LangGraph AI agent application backed by MongoDB.
Terminal escape sequence injection in broot, the interactive Rust-based file tree navigator by Canop, allows any local user with filesystem write access to plant control characters in a filename and have them written verbatim to the terminal of any other user who browses that directory with broot. The vulnerable code path - to_string_lossy() in src/tree/tree_line.rs and src/tree_build/builder.rs - applies no control-character filtering despite an existing doc comment implying sanitization occurs. A proof of concept embedding an OSC 52 clipboard-write sequence confirmed that raw escape bytes reach the terminal unstripped; the terminal emulator then determines the actual impact, ranging from cosmetic disruption to clipboard hijacking. No public exploit identified at time of analysis beyond the reported proof of concept; the vulnerability is not listed in CISA KEV.
Arbitrary code execution in aeon 1.3.0 is triggered when a user loads a maliciously crafted CSV dataset file via the `load_time_series_segmentation_benchmark` or `load_human_activity_segmentation_datasets` functions, both of which passed CSV column values directly to Python's `eval()` built-in without validation. An attacker who convinces a data scientist or researcher to open a crafted dataset file can execute arbitrary Python code with the privileges of the running process. No public exploit has been identified at time of analysis, but the upstream fix commit is public and the vulnerability class is trivially replicable given the use of bare `eval()`.
Remote code execution in aeon 1.3.0 is possible when a user loads a maliciously crafted CSV dataset via the `load_human_activity_segmentation_datasets` or `load_time_series_segmentation_benchmark` functions, which pass unvalidated column values directly to Python's `eval()`. An attacker who can deliver a malicious file or dataset URL to a target data scientist can execute arbitrary Python code in the victim's process with their full privileges. No public exploit has been identified at time of analysis, though ZDI (ZDI-CAN-29160) holds technical details; the upstream fix replacing `eval()` with `ast.literal_eval()` is available as a commit but a tagged patched release has not been independently confirmed.
Arbitrary code execution in @cgauge/yaml (all versions ≤ 0.27.0) is achieved by embedding a custom `!js` YAML tag in a document supplied to the parser; the library's tag handler unconditionally passes the tag's string value to `eval()`, granting attackers the full authority of the Node.js runtime - including filesystem access, environment variable exfiltration, network calls, and subprocess spawning. No safe-mode parsing option or opt-out mechanism exists in the library, meaning every call site that parses attacker-controlled YAML is unconditionally vulnerable. A public proof-of-concept exploit is available via GitHub Gist, and no vendor-released patch has been identified at time of analysis.
Code injection in the Query Wrangler WordPress plugin (versions <= 1.5.57) lets an authenticated low-privilege user reach remote code execution on the host. Because the CVSS vector requires only PR:L (subscriber-level access) with a scope change and full CIA impact, any site allowing self-registration is exposed to complete server compromise by its lowest-tier accounts. There is no public exploit identified at time of analysis, but the 9.9 base score and Patchstack attribution mark it as a high-priority patch item.
Prototype pollution in n8n's JavaScript task runner sandbox allows an authenticated user with Code node access to escape VM isolation and execute arbitrary OS commands within the runner container. Affected versions span the v1.x branch before 1.123.69 and the v2.x branch before 2.33.4 and 2.34.1. The corruption is process-wide, meaning a single malicious execution can poison the prototype chain for all subsequent tenant Code node runs on the same shared runner; on v1.x instances without task runner isolation, the attack surface escalates to the main n8n process itself. No public exploit has been identified at time of analysis and CISA KEV does not list this CVE.
Expression injection in n8n's workflow editor allows an authenticated member to store a malicious payload in a resource-locator field that executes as JavaScript in any other user's browser session when they open the affected node. The root cause is that the editor splices the field's stored value directly into the node type's URL template without sanitizing expression syntax, enabling cross-user script execution within authenticated sessions. No public exploit or CISA KEV listing has been identified at time of analysis, but the CVSS 4.0 score of 8.4 reflects high confidentiality and integrity impact on the vulnerable system.
Server-side request forgery and MVG code injection in n8n's Edit Image node allows authenticated low-privilege users to issue blind outbound HTTP requests or read local files by injecting ImageMagick MVG primitives into the Draw Text operation. All n8n versions before 1.123.69 are affected, confirmed by vendor advisory GHSA-233r-fpgw-fx8x. No public exploit identified at time of analysis, but the High confidentiality impact in the CVSS 4.0 vector signals meaningful data exfiltration risk for instances co-located with sensitive internal services or cloud metadata endpoints.
NoSQL injection in n8n's MongoDB integration node (Find, Delete, and Aggregate operations) allows an attacker who can supply externally-controlled data into a workflow query to inject MongoDB operators such as $ne or $where, transforming an intended single-document lookup into full-collection disclosure, mass deletion, or arbitrary database operations. Versions prior to 1.123.69 (v1 branch) and 2.33.4 / 2.34.1 (v2 branch) are affected, per vendor advisory GHSA-953p-jm2c-8h5j. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CVSS 4.0 subsequent-system impact is rated High across confidentiality, integrity, and availability.
Arbitrary PHP code execution in Royal Addons for Elementor WordPress plugin (all versions before 1.7.1066) is reachable by any user holding the manage_options capability, including non-super subsite administrators on WordPress Multisite who would not otherwise have code-execution rights. The plugin writes unsanitized custom widget markup directly to a server-side file that is subsequently executed as PHP, enabling full server-side code injection. A publicly available exploit exists per WPScan; no CISA KEV listing at time of analysis, though the attack scenario is realistic for any WordPress Multisite deployment with delegated administration.
Remote code injection in chenhg5 cc-connect up to version 1.4.1 allows unauthenticated network attackers to execute arbitrary code by manipulating the `exec` argument passed to the `Authenticate` function in `core/webhook.go`. Tagged by reporters as RCE-capable, the vulnerability stems from unsanitized user input reaching a code execution path within the Go webhook handler. A public exploit has been disclosed; no patch has been released, as the upstream GitHub issue was closed automatically due to maintainer inactivity - leaving affected deployments without an official remediation path.
SPL injection in Splunk Enterprise Security versions below 8.6.1 allows low-privileged authenticated users holding the mc_investigation_read capability to inject Search Processing Language through Analyst Queue search filter field names, gaining access to data and system integrity controls available to scheduled search contexts beyond their authorized scope. The root cause is absent validation of filter field names before inclusion in SPL queries - analogous to SQL injection but within Splunk's proprietary query language. No public exploit has been identified at time of analysis and no CISA KEV listing exists, but the CVSS 8.1 High score reflects meaningful confidentiality and integrity exposure for any account holding the relevant capability.
LDAP injection in the AD LDAP app for Splunk SOAR (versions below 2.3.8) allows authenticated low-privileged users to manipulate Active Directory queries, exposing account enumeration, sensitive attribute disclosure, and unintended modification of AD objects. Exploitation requires only a role with 'run actions' permission within Splunk SOAR - no elevated SOAR admin rights needed. Splunk has released a patch (version 2.3.8); no public exploit code or CISA KEV listing has been identified at time of analysis.
Authenticated low-privilege code injection in Splunk Enterprise allows OS command execution on the host system as the Splunk process account. Affected versions span four active release lines (9.4.x, 10.0.x, 10.2.x, 10.4.x), and the root cause is a missing capability check: Splunk Web accepts Splunk Web Manager XML configuration writes without enforcing the edit_manager_xml permission, meaning any authenticated user can plant attacker-controlled content that executes when the Manager page is rendered. No active exploitation is confirmed in CISA KEV, and no public exploit code has been identified at time of analysis, but the CVSS score of 8.8 (High) and straightforward exploitation path make this a high-priority patching target for Splunk deployments.
SPL injection via Analytics Workspace in Splunk Enterprise allows an unauthenticated attacker to execute arbitrary Search Processing Language queries under the permissions of a phished authenticated user. Affected across four release trains - 9.4 below 9.4.14, 10.0 below 10.0.9, 10.2 below 10.2.6, and 10.4 below 10.4.2 - the flaw stems from insufficient input validation when Analytics Workspace constructs searches from URL-embedded data. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, though exploitation impact scales directly with the victim user's Splunk role and data access.
Reflected SPL injection in Splunk Enterprise's Monitoring Console allows an unauthenticated attacker to execute attacker-controlled Search Processing Language commands under the permissions of a phished authenticated victim. Affected versions span four active release trains: 9.4.x below 9.4.14, 10.0.x below 10.0.9, 10.2.x below 10.2.6, and 10.4.x below 10.4.2. No public exploit or CISA KEV listing exists at time of analysis, though successful exploitation grants full read and write access to all data and actions permitted by the victim's Splunk role.
Reflected SPL injection in Splunk Enterprise's Monitoring Console allows an unauthenticated attacker to execute attacker-controlled Search Processing Language queries under the permissions of a targeted Splunk administrator. The attacker must phish an admin-role user into opening a specially crafted link (CVSS UI:R/AC:H), making opportunistic mass exploitation unlikely, but a successful attack can expose all data indexed and accessible to that admin or corrupt lookup tables. Vendor-released patches are available for all affected branches; no public exploit code and no CISA KEV listing have been identified at time of analysis.
Stored SPL injection in Splunk Enterprise allows an unauthenticated attacker who can reach the management port to register a crafted Deployment Server client identity containing malicious Search Processing Language code, which executes when an administrator opens the Add Data forwarder workflow. All four supported major branches are affected (9.4.x, 10.0.x, 10.2.x, 10.4.x), with vendor-confirmed fixes available. No public exploit has been identified at time of analysis, but successful exploitation yields full confidentiality, integrity, and availability impact on the Splunk platform instance.
Remote code execution in Splunk Enterprise allows any authenticated low-privileged user - one without the 'admin' or 'power' role - to inject and execute arbitrary code on the Splunk platform instance via the Splunk Web Manager Configuration REST API endpoint. The root cause is a missing permission check on the REST API path governing manager configuration writes, meaning Splunk evaluates attacker-supplied configuration values without verifying the caller holds the required role. Exploitation yields full confidentiality, integrity, and availability impact on the Splunk instance; no public exploit has been identified at time of analysis.
Remote code execution in Splunk Enterprise allows any authenticated low-privilege user - one who does not hold the 'admin' or 'power' role - to execute arbitrary code by submitting crafted XML content to the Splunk Web Manager Configuration endpoint. The vulnerability combines two weaknesses: server-side evaluation of manager XML expressions without sufficient input restrictions (CWE-94), and a missing capability check on the configuration route that should gate such access. No public exploit has been identified at time of analysis, but the low attack complexity and low privilege requirement make this a high-priority remediation target across Splunk Enterprise 9.4.x, 10.0.x, 10.2.x, and 10.4.x branches.
GitHub Actions workflow injection in Logto's commitlint.yml exposes versions 1.40.1 through 1.41.0 to arbitrary shell command execution on the project's CI/CD runner, triggered by any GitHub user who can submit a pull request with a crafted title containing shell metacharacters. The PR title was directly interpolated into an inline echo command without sanitization, allowing a single-quote character to terminate the shell string and inject attacker-controlled commands into the ephemeral runner environment. Impact is bounded by a read-only GITHUB_TOKEN and absence of exposed repository secrets; no public exploit is identified at time of analysis, and the issue is fully patched in v1.41.0.
IBM PowerVM Hypervisor across firmware branches FW950 through FW1120 exposes a flaw in the hypervisor call (hcall) interface that allows a root-privileged guest partition user to permanently freeze a virtual processor by issuing a specially crafted hypervisor call, requiring a full platform re-IPL to restore operation - a platform-wide denial of service affecting all co-resident guest partitions. In a subset of cases, exploitation may also result in a small amount of data being written into hypervisor or partition memory, creating a limited integrity impact with no attacker-controlled targeting. No public exploit identified at time of analysis; IBM has released a patch via its support portal.
YAML injection in volsync-addon-controller enables a highly privileged, network-capable attacker to break out of YAML value context when annotation values are rendered into OLM Subscription resources, allowing unauthorized modification of OpenShift operator lifecycle configuration. The root cause (CWE-94) is unsanitized interpolation of Kubernetes annotation strings into generated YAML, and the impact includes high integrity and availability consequences for cluster software management. Exploitation is gated behind high-privilege cluster access and the non-default 'volsync-addon-deploy-type: olm' annotation; no public exploit or CISA KEV listing has been identified at time of analysis.
Code injection in marimo before 0.23.15 allows an attacker who can deliver a crafted notebook file to execute arbitrary operating system commands on the victim's machine simply by having the victim open the notebook in edit mode. The vulnerability resides in the notebook configuration handler's MCP (Model Context Protocol) server entry processing: marimo reads attacker-controlled command values from the notebook's configuration and spawns them as local subprocesses before any notebook cell runs, giving the attacker immediate code execution with no further interaction required. No public exploit or CISA KEV listing has been identified at time of analysis, but the CVSS 4.0 score of 8.7 and PR:N vector reflect the low barrier to exploitation once a victim opens a malicious file.
Arbitrary code execution in Orval before 8.21.0 arises when the code generator emits an unescaped backtick (or ${...}) from a Swagger/OpenAPI spec's servers[0].url directly into the JavaScript template literals of generated request and URL-builder functions. Because the malicious spec content breaks out of the template literal, attacker-controlled JavaScript runs the moment the generated client is built or invoked — poisoning developer machines, CI runners, test harnesses, and downstream applications. The flaw only manifests when output.baseUrl.getBaseUrlFromSpecification is enabled; it is fixed in 8.21.0 and, per CVSS 4.0 9.3, no public exploit is identified at time of analysis though a detailed fix commit and regression tests are publicly available.
Arbitrary code execution in Orval (orval-labs/orval) before 8.21.0 allows an attacker who controls an OpenAPI v3 or Swagger v2 specification to run JavaScript in the developer, CI, test, or application environment that generates or imports the resulting client. The flaw lives in the zod schema generator (packages/zod/src/index.ts, formatDefaultValue), which emits a schema default value containing a ${...} interpolation or backtick into a module-level template literal without safe encoding, so the payload is evaluated the moment the generated module is loaded. It is fixed in 8.21.0; there is no public exploit identified at time of analysis and it is not listed in CISA KEV, though the vendor advisory and fixing PR include demonstrative injection payloads.
Code execution in Orval before 8.21.0 occurs when its zod schema generator processes an attacker-controlled OpenAPI v3 or Swagger v2 specification: a ${...} expression or backtick placed in an enum default value is written unescaped into a module-level JavaScript template literal, so simply importing the generated schema module evaluates the attacker's code in the developer, CI, test, or application runtime. This is a CWE-94 code-injection flaw (CVSS 9.3) affecting the packages/zod/src/index.ts formatDefaultValue routine. No CISA KEV listing and no separately published exploit exist at time of analysis, though the vendor's fix commit ships tests containing working injection payloads.
Code injection in Orval before 8.21.0 lets an attacker-controlled OpenAPI v3 / Swagger v2 specification achieve arbitrary code execution: a double-quote character in a query parameter name is written verbatim into the generated request-validation zod.object({...}) schema, so importing that generated module evaluates embedded JavaScript. Any developer workstation, CI runner, test harness, or application that generates a zod client from a malicious or tampered spec is affected. There is no public exploit identified at time of analysis, but the vendor's own fix commit ships tests demonstrating payloads such as require('fs').execSync('id'); it is not listed in CISA KEV and no EPSS score was provided.
Arbitrary code execution in Orval (OpenAPI/Swagger TypeScript client generator) before 8.21.0 lets an attacker who controls an OpenAPI v3 or Swagger v2 specification inject JavaScript that runs when the generated zod schema module is imported. A ${...} template expression or backtick placed in an array item's default value is emitted verbatim into a module-level template literal by formatDefaultValue in packages/zod/src/index.ts, so importing the generated code executes attacker payloads in the developer, CI, test, or application environment. No CISA KEV listing exists, but the fixing PR (#3692) ships tests demonstrating concrete injection payloads such as backtick-plus-require('child_process').execSync('id'), so working exploit technique is effectively public; EPSS was not provided.
Code injection in Orval (orval-labs/orval) before 8.21.0 allows an attacker who controls an OpenAPI v3 or Swagger v2 specification to achieve arbitrary code execution in the environment that generates and imports the client. A double-quote character in a header parameter name is written unescaped into the generated request-validation zod.object({...}) schema, so a crafted spec breaks out of the string literal and injects JavaScript that runs the moment the generated zod module is imported — impacting developer workstations, CI runners, test harnesses, and any application that loads the generated code. It is fixed in 8.21.0; no public standalone exploit or CISA KEV listing exists, though the patch's own test suite includes working injection payloads that demonstrate the vector.
Code injection in Orval, a TypeScript client generator for OpenAPI v3 and Swagger v2 specs, allows arbitrary JavaScript execution when a malicious API specification is processed. In versions prior to 8.21.0, a ${...} interpolation or backtick placed in a header parameter's default value is emitted unescaped into a module-level template literal by the zod schema generator (formatDefaultValue in packages/zod/src/index.ts), so the payload runs the moment the generated schema module is imported in a developer, CI, test, or application environment. No public exploit has been identified at time of analysis, though the fixing PR (#3692) ships proof-of-concept-grade tests demonstrating require('child_process').execSync payloads; the flaw carries a high CVSS 4.0 score of 9.3.
Code injection in Orval before 8.21.0 lets an attacker who controls an OpenAPI v3 or Swagger v2 specification embed executable JavaScript into generated client code. An unescaped backtick (and `${...}` / backslash) in an OpenAPI path, server URL, or server-variable default is emitted verbatim into the template literals Orval generates for axios, fetch, react-query, and SWR clients, so attacker-controlled code runs whenever a generated request, URL-builder, or query-key function is invoked - inside the developer machine, CI pipeline, test suite, or running application. The upstream fix PR and security advisory include demonstrative injection payloads (e.g. `require('child_process').execSync('id')`), so working proof-of-concept exists, but there is no evidence of active exploitation (not in CISA KEV).
Remote code execution in TrueConf Server (versions 5.3.x through 5.3.9, 5.4.x through 5.4.9, 5.5.x through 5.5.5, and earlier) allows an unauthenticated network attacker reaching TCP port 4307 to submit a specially crafted script that escapes the product's isolated/sandboxed execution environment and runs arbitrary code on the underlying host. Reported by Kaspersky ICS-CERT and classified as CWE-94 code injection, the flaw carries a CVSS 4.0 base score of 9.5 driven by full confidentiality, integrity, and availability impact on both the vulnerable component and the host system it breaks out to. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though the sandbox-escape-to-host primitive makes it a high-value target.
Remote code execution in Grav CMS prior to 2.0.7 allows low-privileged page editors to execute arbitrary OS commands as the web server user via a callable-injection flaw in Blueprint::dynamicData(). An account holding admin.pages or api.pages.write permission can embed a malicious data-options@ blueprint directive in page frontmatter that chains through Utils::arrayFilterRecursive() as a trampoline into PHP's system() function, executing the command when the page is rendered. No CISA KEV listing or public exploit code is identified at time of analysis; the full attack technique is documented in GitHub Security Advisory GHSA-fj2p-qj2f-74v5.
Authenticated remote code execution affects Talebook (MyBooks/PoxenStudio) ebook management server versions 3.41.2 and earlier, where an administrator can inject arbitrary Python into the auto-generated auto.py settings module via a crafted SOCIAL_AUTH key name. Because the server imports auto.py as a live module and can auto-restart to reload it, injected statements execute with the service account's privileges, enabling data disclosure, file modification, persistence, or service disruption. No public exploit is identified at time of analysis; the fix is version 3.42.0, and chained authorization/registration weaknesses noted by the vendor could lower the effective privilege barrier.
Remote code execution in ArcadeDB's Gremlin query engine exposes any deployment running arcadedb-gremlin through version 26.7.3 to full OS command execution by any authenticated user, including those with only read-only database roles. The flaw is a silent fallback in ArcadeGremlin.executeStatement() that routes parameterized queries failing gremlin-lang parsing to the unrestricted Groovy scripting engine, which can invoke arbitrary Java and OS-level code as the server process user. No public exploit has been identified at time of analysis, but the minimal privilege bar - any valid credential - makes this a critical upgrade priority for all ArcadeDB deployments.
Config-name injection in GitPython <= 3.1.57 enables arbitrary git-config directive forgery and remote code execution via `core.sshCommand` or `core.hooksPath`. The option-name validator in `git/config.py` only blocks CR/LF/NUL, allowing `=`, `#`, and whitespace to pass unchecked; `write_section` then writes the option name verbatim, causing git to parse attacker-supplied content as a valid directive. Exploitation requires a calling application to forward attacker-influenced input to `config_writer.set_value()` as the option-name argument, and a proof-of-concept is publicly confirmed in the vendor GHSA advisory. No CISA KEV listing is present at time of analysis.
Arbitrary file overwrite in GitPython before 3.1.58 allows attackers who can influence treeish arguments passed to IndexFile.from_tree, IndexFile.reset, or IndexFile.merge_tree to clobber any file writable by the host process with a valid git-index blob. The three affected methods in git/index/base.py forward caller-controlled strings directly to git read-tree with no option sanitization and no -- argument terminator, enabling injection of --index-output=<path>; git's last-occurrence-wins behavior lets the injected flag override the library's internal temp path. A proof-of-concept is publicly documented in GHSA-4gmw-gg2m-w46p; no CISA KEV listing was present at time of analysis.
Pre-authentication PHP code injection in Balbooa Forms, a commercial Joomla form-builder extension, in all versions before 2.4.3.2 lets a remote unauthenticated attacker run arbitrary server-side code. The flaw stems from the optional custom-PHP post-submission handler being executed through eval() after the [URL parameter = X] shortcode is replaced with the raw, unescaped value of an attacker-controlled query parameter. No public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV, but the combination of unauthenticated network reach and full remote code execution makes this a maximum-severity issue wherever a matching handler is configured.
FreeBSD's wg(4) WireGuard kernel driver silently accepts packets bearing invalid Poly1305 authentication tags, completely defeating WireGuard's cryptographic integrity guarantee on affected FreeBSD versions. The driver dispatches decrypt operations to the OpenCrypto Framework (OCF) but never checks the returned MAC verification result, meaning tampered or forged ciphertext passes through as legitimate plaintext. Two distinct attack paths exist: an on-path attacker who can intercept WireGuard UDP traffic can modify ciphertext and authenticated data without detection, while a remote attacker with knowledge of the receiver's replay window bounds can inject forged transport data packets directly. No public exploit has been identified and EPSS sits at 0.18% (8th percentile), indicating no widespread automated exploitation at time of analysis.
Unauthenticated PHP object/global variable injection in the Broken Link Checker WordPress plugin before 2.4.12 allows attackers to overwrite arbitrary PHP global variables via unfiltered query variables on sites using plain permalinks, escalating to remote code execution when a classic (non-block) theme is active. The flaw is reachable by any unauthenticated visitor (CVSS 3.1 base 9.0, PR:N) but requires the AC:H preconditions of plain permalinks plus a classic theme, so it is not universally exploitable. No public exploit has been identified at time of analysis, and the EPSS probability is low (0.22%, 13th percentile), indicating no observed mass exploitation yet.
Sandbox escape leading to host remote code execution in Kobako, a Ruby gem that runs untrusted mruby guest scripts in a WASM sandbox. The transport dispatcher forwarded guest-supplied method names directly to `Object#public_send` on host-bound Service objects without restricting them to the object's own methods, letting a guest pivot through the public `send` into private `Kernel#eval` and execute arbitrary Ruby in the host process. All released versions 0.1.0-0.9.0 are affected; the vendor advisory (GHSA-7pwq-q9jf-539h) documents a working proof-of-concept and CVSS is rated 10.0, though there is no CISA KEV listing or EPSS data provided.
Prompt injection in Context7 through version 2.1.2 allows an attacker with low-level write access to the Custom AI Instructions configuration to plant malicious directives that hijack connected AI coding agents when those agents make routine library documentation requests via the MCP server. The poisoned instructions cause the agent to exfiltrate credentials from environment files (such as .env files containing API keys and tokens) to an attacker-controlled endpoint, and to perform destructive file deletion on the victim developer's machine. No active exploitation has been confirmed in CISA KEV, but no public patch version has been independently verified at time of analysis.
Server-side template injection in GBIF Integrated Publishing Toolkit (IPT) versions before 3.3.4 permits remote low-privileged authenticated attackers to read arbitrary server-side files and access internal application state by injecting template directives into unsanitized user-controlled input. Disclosed by Mandiant (MNDT-2026-0016), the flaw maps to CWE-1336 and carries a CVSS 4.0 score of 7.6 with high confidentiality and integrity impact on the vulnerable system. No confirmed active exploitation or CISA KEV listing exists at time of analysis, but the potential for credential and configuration file exposure makes this a meaningful risk for biodiversity data publishing deployments.
Response header injection in Joomla! CMS download views affects all 3.x releases from 3.0.0 through 5.4.7 and the 6.x branch from 6.0.0 through 6.1.2, enabling a high-privileged attacker to inject arbitrary HTTP response headers into download responses. The missing output sanitization in multiple download view handlers exposes end users to Reflected File Download (RFD) and content-type confusion attacks, where a browser can be tricked into treating a server response as a dangerous executable file. No public exploit code has been identified at time of analysis, and CISA KEV status has not been confirmed.
Remote code execution in MyBB 1.8.13 through 1.8.39 lets an attacker inject arbitrary PHP into the generated database configuration file when the web-based installer (install/index.php) remains accessible. The installer sanitizes database configuration values with addcslashes() but omits the backslash from its escaped-character set, so crafted input can break out of the single-quoted PHP string and execute attacker-controlled code. Rated CVSS 9.8; no public exploit identified at time of analysis, though the fixing commit publicly reveals the exact one-character root cause, lowering the barrier to weaponization.
Mail header injection in MyBB's Email User feature (prior to 1.8.40) allows CRLF sequences embedded in the unsanitized `fromname` HTTP parameter to inject arbitrary SMTP headers - including Bcc, Reply-To, and Return-Path - into outgoing forum emails. The attack surface is conditional on two prerequisites: the `mail_handler` must be set to PHP (the default) and the `cansendemail` group permission must be enabled for the attacker's user group, including guests for the unauthenticated path. No public exploit code exists and this vulnerability is not listed in CISA KEV, but successful exploitation turns the forum's mail infrastructure into a phishing or spam relay, weaponizing the forum's domain reputation against recipients.
Code injection in Vim prior to 9.2.0845 enables arbitrary operating-system command execution by an attacker who can supply a malicious ctags-format tags file. The StructMembers() function in ccomplete.vim embeds typeref: and typename: field values from that tags file into a dynamically constructed vimgrep pattern using escaping that only covers '/' and '\', leaving regex metacharacters such as '[' active; an unclosed bracket breaks Vim's pattern parser, causing the remainder of the tag value to be interpreted as Ex commands where '|' acts as a command separator. Exploitation requires the victim to actively invoke C omni-completion (CTRL-X CTRL-O) while editing a C file referencing the malicious tags entry; no public exploit is identified at time of analysis, though the fix commit's test suite embeds a working proof-of-concept payload, substantially lowering the barrier to weaponization.
Shell command injection in CodeWhale before version 0.8.64 enables arbitrary code execution on a victim developer's machine through a malicious repository config file. By committing a crafted `.codewhale/config.toml` containing `allow_shell = true` to any repository, an attacker can override the tool's shell access controls; when the target developer clones and opens the repository in CodeWhale, the AI agent gains unrestricted access to `exec_shell` and `task_shell` built-in tools and executes arbitrary shell commands without the user's explicit consent. No public exploit has been identified at time of analysis and no CISA KEV listing is confirmed, though the attack mechanics are straightforward and a vendor patch is available.
Remote code execution in CodeWhale (packages codewhale and codewhale-tui) versions 0.8.41 through 0.8.63 allows an attacker to execute arbitrary Python code on the victim's machine by exploiting a hardcoded approval bypass in the rlm_eval built-in tool. The tool's approval_requirement() method returned ApprovalRequirement::Auto, causing the engine to silently skip user approval prompts regardless of the operator's configured --approval-policy, enabling prompt injection attacks through any external content the agent reads. No public exploit has been identified at time of analysis, but the attack surface encompasses any CodeWhale agent workflow that fetches untrusted content such as web pages, repository files, or MCP tool results.
Arbitrary shell command execution in Oh My Zsh's dotenv plugin allows any syntactically valid Zsh command embedded in a `.env` file to run with the victim user's privileges when they `cd` into a directory containing that file. The plugin unconditionally `source`d the `.env` file as a shell script rather than parsing it as a structured key-value store, meaning malicious git repositories, shared project directories, or downloaded archives could weaponize routine developer directory-navigation. Exploitation is silent when `ZSH_DOTENV_PROMPT=false` or when the user presses Enter at the default prompt without reviewing the file; no CISA KEV listing or public exploit code was identified at time of analysis.
Remote code execution in the WP Compress (Image Optimizer) WordPress plugin before version 7.20.01 allows unauthenticated attackers to inject and execute arbitrary PHP code on the underlying web server. Reported by Patchstack (EUVD-2026-60774) and rated CVSS 10.0 with a network, no-privilege, no-interaction vector, this is a maximum-severity flaw affecting every deployment running a vulnerable plugin version. No public exploit identified at time of analysis, though the code-injection root cause and unauthenticated reachability make it a high-priority patch target.
Remote code execution in the Cwicly WordPress page-builder plugin (versions 1.4.4 and earlier) allows a low-privileged Contributor-level account to inject and execute arbitrary PHP code on the server, per a Patchstack advisory. Because a Contributor is a low-trust role often granted for guest posting, this collapses the boundary between content authoring and full server compromise. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV, but the 9.9 CVSS score and CWE-94 code-injection class make it a high-priority patching target.
Server-side template injection in grav-plugin-api before 1.0.15 enables remote code execution for any attacker holding api.pages.write permission. The translate() endpoint accepts unsanitized Twig template syntax in header and content parameters, which can be persisted to a page with process.twig enabled and evaluated by the Twig engine at render time. No public exploit or CISA KEV listing has been identified at time of analysis, but the combination of network-reachable exploitation path and high confidentiality and integrity impact from full server-side template evaluation makes this a serious risk for any Grav installation exposing the plugin API to lower-trust users.
Remote code execution in Grav CMS before 2.0.15 allows attackers holding page-edit or blueprint-config privileges to write arbitrary PHP into web-accessible files and execute it. The flaw lives in the Blueprint dynamic-data 'bare-function' validation, which relies on an incomplete denylist rather than a positive allowlist, letting the error_log function be invoked through a data directive to append attacker-controlled PHP payloads. Reported by VulnCheck; no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Arbitrary code execution is reported in PbootCMS 3.2.15, a PHP-based open-source content management system, reachable through several front-end controllers (MemberController.php, UserController.php, CommentController.php, ContentController.php) and the shared helper.php. Classified as CWE-94 code injection with a CVSS 9.8 and tagged PHP/RCE, it would let an attacker run attacker-supplied PHP on the web server. No public exploit is identified at time of analysis and it is not listed in CISA KEV; note that one of the two primary references is a document titled 'URL Redirection Vulnerability,' which conflicts with the code-execution description and should be verified.
Server-side template injection in JumpServer prior to 4.10.17 enables an authenticated administrator with Applet Host management and deployment permissions to plant Jinja2 expressions in the IP/Host or Core Service Address fields, which Ansible then evaluates as live template expressions during Applet Host deployment, yielding arbitrary OS command execution on the JumpServer control node. The patch was released in v4.10.17, confirmed via the GitHub release tag, and no public exploit code or CISA KEV entry has been identified at time of analysis. Because the control node manages downstream bastion targets, a successful exploit has blast radius well beyond the JumpServer process itself.
Arbitrary Python code execution in FreeCAD's BIM module (versions 0.19 through pre-1.1.1) is triggered when a user opens a malicious project template file through the BIM Project Manager's Load Template function. The loadTemplate() method in BimProjectManager.py passes FCStd metadata fields (wpposition, wpu, wpv, wpaxis) directly to Python's built-in eval(), enabling an attacker who can deliver a crafted template to achieve full code execution under the victim's user account. No public exploit has been identified at time of analysis; the vendor-released patch is confirmed in version 1.1.1.
Arbitrary Python code execution in FreeCAD's BIM Workbench (versions 0.19 through 1.1.0) is triggered when a user creates a TechDraw page from a malicious SVG template, due to an unsafe eval() call in BimTDPage.py at line 87. Exploitation requires social engineering - an attacker must deliver a crafted SVG template to a victim who then performs the TechDraw page creation action. No public exploit has been identified at time of analysis and no CISA KEV listing exists, but the vulnerability is structurally trivial (direct eval of attacker-controlled input, CWE-95) and the fix is available in version 1.1.1.
Remote code execution via crafted .FCStd document in FreeCAD prior to 1.1.2 allows arbitrary Python execution when a victim opens a malicious file. The deserialization path in PropertyPythonObject::Restore() passes attacker-controlled module names directly to PyImport_ImportModule(), executing module-level Python code on import; the legacy pickle branch additionally invokes an attacker-controlled class constructor via PyObject_CallObject(). No public exploit or CISA KEV listing is identified at time of analysis, but exploit construction is straightforward for any researcher who can craft the FCStd XML schema.
Terminal escape sequence injection in powerlevel10k (all versions through 1.20.17) allows any attacker who controls a package.json file on a victim's filesystem to emit arbitrary terminal control sequences on every shell prompt render when the victim navigates into the affected directory. The `prompt_package` segment in `internal/p10k.zsh` passed the `P9K_PACKAGE_VERSION` variable to the terminal without applying Zsh's `(V)` sanitization flag, meaning raw ANSI or OSC escape bytes in the version field reach the terminal emulator unfiltered. No public exploit or CISA KEV listing is identified at time of analysis; the CVSS 4.0 score of 4.8 reflects limited integrity impact and required user interaction.
Unauthenticated data tampering in GitLab CE/EE (18.2-18.11.10, 19.0-19.0.7, 19.1-19.1.5, 19.2-19.2.3) lets a remote attacker modify or delete public projects and user data by abusing a GraphQL directive, per CVE-2026-19478 (CVSS 9.4). The flaw was self-reported by GitLab and publicly available exploit code exists via a HackerOne disclosure, though it is not listed in CISA KEV. Impact is weighted toward integrity and availability rather than data theft (CVSS C:L/I:H/A:H).
Cross-site scripting in Legora before 2026-08-14 allows attackers with content-submission access to execute arbitrary JavaScript in victims' browsers by exploiting an eval() call in the gray-matter JavaScript front-matter parser, which fires before Mermaid SVG sanitization runs. The impact is materially elevated on Word and Outlook add-in surfaces where bearer session tokens are persisted in localStorage, enabling session hijacking beyond the browser context. No public exploit code or active exploitation (CISA KEV) has been identified, though the CVSS 4.0 subsequent-system scores of SC:H and SI:H reflect real-world session-token theft risk in add-in deployments.
Code injection in sqlparse prior to 0.6.0 allows attackers to escape generated Python and PHP source-code snippets by supplying crafted SQL containing backslashes immediately before quote characters, exploiting a missing pre-escaping step in the output formatting filters. The flaw resides in sqlparse/filters/output.py, which escapes quotes without first escaping pre-existing backslashes, causing the generated escape to neutralize the backslash rather than the quote and allowing attacker-controlled content to appear outside the intended string literal as executable code. Publicly available exploit code exists via a validated Docker-based proof-of-concept published in GHSA-3496-9g83-7v6x; no confirmed active exploitation in CISA KEV at time of analysis.
Remote code execution in Regular Labs Sourcerer for Joomla (versions before 14.0.0) allows unauthenticated attackers to inject and execute arbitrary PHP via {source} blocks. The extension parses {source} tags found anywhere in Joomla's final rendered HTML without reliably verifying where that content originated, so attacker-controlled reflected input reaching the page body gets evaluated as trusted code. Rated CVSS 4.0 10.0 (critical); no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Sandbox escape in the openssl_encrypt Python library (jahlives) before 1.4.0 lets attacker-supplied plugin code break out of the IsolatedPluginExecutor and run arbitrary OS commands. The restricted exec() environment still leaks live Python type objects, so an attacker walks the class hierarchy to reach system primitives despite the intended sandbox. Rated CVSS 4.0 9.3 (critical) and reported by VulnCheck; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Remote code execution in the Fabrik extension for Joomla (all versions 1.0.0 through 4.7.2) allows unauthenticated attackers to run arbitrary PHP through the extension's PHP form element, which evaluates user-supplied code. Rated CVSS 10.0 with a network, no-privileges, no-interaction vector and full confidentiality/integrity/availability impact including scope change, this yields complete compromise of the underlying Joomla host. No public exploit identified at time of analysis, but the triviality of PHP-eval injection makes weaponization straightforward once details circulate.
Arbitrary code injection in the Natural Language Toolkit (NLTK) before 3.9.3 stems from the downloader module extracting downloaded corpora and model packages without verifying their integrity, allowing an attacker positioned to tamper with the download (man-in-the-middle or DNS poisoning) to substitute malicious archive contents that are unpacked onto the victim host. All NLTK versions prior to 3.9.3 are affected (CWE-494). Reported by VulnCheck; a vendor patch exists, but no public exploit has been identified and it is not listed in CISA KEV.
Null byte and CRLF injection in Netty's SOCKS4 and SOCKS5 client encoders (Socks4ClientEncoder, Socks5ClientEncoder) allows an attacker who controls domain address or authentication fields to truncate or alter proxy connection parameters, enabling domain spoofing, userid truncation, authentication data injection, and protocol confusion. Affected are all Netty releases in the 4.1.x branch through 4.1.136.Final and the 4.2.x branch through 4.2.16.Final - both branches have been patched. No public exploit code has been identified at time of analysis and this CVE is not listed in CISA KEV, but the integrity impact on downstream SOCKS proxy routing is concrete.
Unauthenticated shortcode injection in the kk Star Ratings - Rate Post & Collect User Feedbacks WordPress plugin (all versions through 5.4.10.3) allows any remote, unauthenticated attacker to execute arbitrary WordPress shortcodes by supplying a crafted payload to the plugin's AJAX handler. The flaw exists because the wp_ajax_kk-star-ratings action passes a user-controlled 'payload' parameter directly to do_shortcode() without allowlisting or sanitizing which shortcode tags are permitted. No public exploit has been identified at time of analysis and this CVE does not appear in the CISA KEV catalog; however, threat intelligence sources tag this as RCE, indicating that practical impact can escalate significantly depending on what shortcodes co-installed plugins register.
Privilege boundary bypass in the Forminator Forms WordPress plugin (versions 1.40.0 through 1.57.0.5) enables any site-level administrator on a WordPress multisite network to modify a network-wide setting that triggers arbitrary code execution across all sites on the network, effectively allowing lateral escalation from single-site admin to full network compromise. This collapses the critical trust boundary between WordPress multisite's site administrator and network (super) administrator roles. No public exploit or CISA KEV listing exists at time of analysis, but the EPSS score of 0.18% (8th percentile) indicates low automated exploitation activity - not low potential impact.
Arbitrary code execution in the JSONata JavaScript library (npm 'jsonata') before 1.8.8 and 2.2.1 lets an attacker who controls a JSONata expression break the engine's object-integrity guarantees and run OS commands on the host. By chaining an overwrite of $clone, deconstruction of internal lambdas via $merge.*, and abuse of proc.arguments.forEach in applyProcedure, a crafted expression reaches process.getBuiltinModule('child_process') and executes code with the privileges of the Node.js process. A complete working proof-of-concept is published in the GitHub advisory; publicly available exploit code exists, though the issue is not listed in CISA KEV and no active exploitation is confirmed.
Arbitrary code execution in the JSONata JSON query/transformation library (npm 'jsonata') lets an attacker who controls a JSONata expression break out of the evaluation context and run OS commands with the host process's privileges. The flaw stems from a bypassable hasOwnProperty check in environment.lookup that permits prototype-chain traversal to reach process.getBuiltinModule('child_process'). A working proof-of-concept is published in the vendor GHSA advisory, and vendor patches (1.8.8 and 2.2.1) are available; no CISA KEV listing has been identified.
Arbitrary code execution in JSONata (npm 'jsonata') versions up to 1.8.7 and 2.0.0-2.1.x allows an attacker who controls a JSONata expression to break out of the query engine and run OS commands via Node's child_process. The flaw stems from the lookup function reaching inherited prototype members (setters/getters, constructor, valueOf) to obtain process.getBuiltinModule and call execSync, executing code with the host process's privileges. Publicly available exploit code exists in the GHSA advisory, and CVSS 4.0 rates it 9.3 (Critical); there is no evidence of active exploitation.
Remote code execution in Xorbits Inference (Xinference) 2.5.0 and earlier lets a remote attacker run arbitrary OS commands in the server process by abusing an unsafe eval() in the Llama3 tool-call parser. Any request to the OpenAI-compatible /v1/chat/completions endpoint with a tools field triggers evaluation of model-generated Python, so an attacker who steers the model's output via a crafted prompt achieves full server compromise; because authentication is disabled in the default deployment, the vendor advisory rates this exploitable by an unauthenticated remote attacker. This is fixed in 2.7.0; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Compile-time PHP code injection in the Phalcon (cphalcon) PHP framework's Volt template compiler (versions 5.15.0 and earlier) lets an attacker who can influence Volt template source achieve remote code execution. The Volt `join` filter emits the separator and array arguments as raw, unescaped bytes into the generated PHP, so quote-breaking content escapes the `join('…')` call and is written into the cached compiled template that is then require()'d at render time. Publicly available exploit code exists (a working PoC that runs shell_exec is published in the GHSA advisory); the issue is not listed in CISA KEV and no active exploitation is confirmed.
Arbitrary code execution in Facebook Research Hydra prior to version 1.3.4 allows any party who can supply untrusted configuration - including YAML config files, CLI overrides, or ML model metadata - to invoke dangerous Python callables through hydra.utils.instantiate(). The vulnerability stems from _resolve_target() accepting any Python callable path without restriction, enabling an attacker to trigger functions such as os.system, subprocess.Popen, or builtins.exec inside the consuming application's process. No public exploit code has been identified at time of analysis, and no CISA KEV listing exists; the upstream fix is confirmed shipped in v1.3.4.
Code injection in the AWS Athena Federated Query Neptune connector (versions 2024.15.1 through 2026.28.1) allows a low-privileged user with query access to Neptune via Athena to reach into and read properties of the AWS Lambda function that provides the connector's compute. Because Lambda environment properties commonly hold configuration and credential material, this exposes the underlying execution context to an authenticated attacker. No public exploit identified at time of analysis; the flaw was reported internally by Amazon (AMZN) and carries a CVSS 4.0 base score of 9.4.
Process-wide Mustache HTML escaping is permanently disabled in Unleash (all versions prior to 8.0.3) from the first moment any notification addon formats a feature event, allowing an editor-level user who has placed Slack or Teams link syntax in their unrestricted username to inject attacker-controlled hyperlinks into every configured outbound notification channel - including Slack, Microsoft Teams, Datadog, New Relic, and email. The scope change (S:C in CVSS) reflects that the vulnerable assignment in FeatureEventFormatterMd contaminates Mustache rendering across email-service.ts, webhook.ts, datadog.ts, and new-relic.ts for the lifetime of the Node.js process. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis.
Remote code execution in Omnigent's multi-tenant runner allows any authenticated user to hijack the runner process by uploading a crafted agent bundle that specifies a dotted Python import path (e.g., subprocess.check_output) as a server-side callable tool. The server's bundle validator failed to inspect the callable field, so the runner blindly imported and executed the specified Python symbol with its own process permissions. All Omnigent deployments prior to version 0.3.0 running in shared or multi-tenant mode are affected; no public exploit has been identified at time of analysis, though the GHSA advisory and fix PR provide a detailed exploitation roadmap.
Remote code execution in Omnigent, an open-source AI agent framework and meta-harness, before version 0.3.0 allows an authenticated user with session edit access to hijack shared/template agents and achieve command execution on the runner host. The PUT /sessions/{session_id}/agent endpoint enforces LEVEL_EDIT on the session but fails to reject a bound shared or template agent (whose agent.session_id is None), letting the attacker replace the shared agent bundle and inject a malicious stdio MCP server that later executes an attacker-controlled command. There is no public exploit identified at time of analysis, but a vendor patch (0.3.0) and the fixing commit are public.
Remote code execution in SPIP CMS versions prior to 4.4.21 lets unauthenticated attackers run arbitrary PHP/OS commands by abusing the template engine's X-Spip-Filtre header handling. A newline injected into a GET parameter forces analyse_resultat_skel() to treat an attacker-supplied header() call as a template filter chain, and a working Metasploit module (intval|_request|system) already achieves full command shell access. The CVE description claims in-the-wild exploitation in August 2026; publicly available exploit code exists, making this a top-priority patch.
Line-protocol injection and log spoofing in Spring Micrometer's StatsD and LoggingMeterRegistry components allow network-reachable attackers to forge arbitrary metrics and log entries by embedding newline characters into user-supplied strings that flow unvalidated into meter names, tag keys, or tag values. Affected deployments span the 1.9.x through 1.17.x release lines of io.micrometer:micrometer-registry-statsd and io.micrometer:micrometer-core when the Datadog or Etsy StatsD flavor is active, or when LoggingMeterRegistry is in use. No public exploit has been identified at time of analysis, though the integrity-focused impact carries real risk for organizations whose incident-response workflows depend on Micrometer-sourced telemetry.
XML injection in joshnuss xml_builder (Elixir) allows an attacker who can influence element names, attribute names, or doctype identifiers to inject arbitrary XML markup - including extra elements, comments, and event-handler attributes - into the serialized document output. All library releases from 0.0.1 through 2.4.0 are affected; the vulnerability resides in the core XmlBuilder.element and XmlBuilder.generate API surface. No active exploitation has been confirmed (CVE is not in CISA KEV), and no standalone public exploit code has been identified, though the GitHub security advisory includes demonstrative test cases.
XML injection in joshnuss xml_builder (versions 0.0.7 through before 2.4.1) enables content spoofing and XML structure manipulation when attacker-controlled data reaches CDATA sections generated by the library. The escape/1 function concatenates CDATA content verbatim without splitting on the ]]> delimiter sequence, allowing premature closure of the CDATA section and injection of arbitrary XML markup into the output document. A vendor patch is available in version 2.4.1; no public exploit code and no CISA KEV listing have been identified.
Argument injection in Apache InLong's Agent Installer (versions 2.0.0 through 2.3.x) enables arbitrary shell command execution via the ModuleManager's ExcuteLinux.exeCmd() method, which applies no input filtering or whitelist validation. Any deployment running InLong agents within the affected version range is exposed to OS-level command execution on the agent host system. Apache has released version 2.4.0 as the authoritative fix; no public exploit has been identified at time of analysis.
Remote code execution via file upload bypass in the Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin (versions before 1.3.9.9) is exploitable by unauthenticated attackers against public-facing WordPress contact forms. The plugin strips certain characters from uploaded filenames as a sanitization step but fails to re-validate the resulting filename against its file type allowlist, enabling an attacker to craft a filename that survives stripping as a server-executable extension (e.g., PHP). A publicly available proof-of-concept exploit exists; a vendor patch is available at version 1.3.9.9 and should be applied immediately given the no-authentication, network-accessible attack surface.
Remote code execution in SPIP before 4.4.20 allows unauthenticated attackers to run arbitrary PHP on the server by exploiting flawed detection of `<?php` blocks combined with var_export's mishandling of input containing a '<' character. The CVE description itself reports exploitation in the wild during August 2026, and the flaw is network-reachable with no authentication or user interaction (CVSS 9.8). This is a CWE-94 code-injection issue affecting all SPIP releases prior to the fixed 4.4.20.
HTTP request smuggling (CL.TE desynchronization) in Cesanta Mongoose embedded web server before 7.22 lets a remote unauthenticated attacker craft a request bearing both Content-Length and Transfer-Encoding: chunked headers. Because mg_http_parse()/http_cb() accept both and prioritize chunked encoding while a front-end reverse proxy that prefers Content-Length draws a different request boundary, an attacker can smuggle a second request that reads or modifies resources belonging to another user's context. No public exploit is identified at time of analysis; the issue is fixed in 7.22 which rejects requests containing both headers.
NoSQL operator injection in LangGraph's MongoDB persistence libraries (langgraph-checkpoint-mongodb < 0.3.0 and langgraph-store-mongodb < 0.4.0) allows authenticated API callers to embed MongoDB query operators directly in filter parameters, bypassing per-tenant query predicates and exposing other tenants' checkpoint and store data. The flaw affects MongoDBSaver.list(), MongoDBSaver.alist(), and MongoDBStore.search() methods whenever filter arguments derive from user-controlled input in multi-tenant deployments. No public exploit or CISA KEV listing exists at time of analysis, but the cross-tenant data exposure is a concrete, high-impact risk for any multi-tenant LangGraph AI agent application backed by MongoDB.
Terminal escape sequence injection in broot, the interactive Rust-based file tree navigator by Canop, allows any local user with filesystem write access to plant control characters in a filename and have them written verbatim to the terminal of any other user who browses that directory with broot. The vulnerable code path - to_string_lossy() in src/tree/tree_line.rs and src/tree_build/builder.rs - applies no control-character filtering despite an existing doc comment implying sanitization occurs. A proof of concept embedding an OSC 52 clipboard-write sequence confirmed that raw escape bytes reach the terminal unstripped; the terminal emulator then determines the actual impact, ranging from cosmetic disruption to clipboard hijacking. No public exploit identified at time of analysis beyond the reported proof of concept; the vulnerability is not listed in CISA KEV.
Arbitrary code execution in aeon 1.3.0 is triggered when a user loads a maliciously crafted CSV dataset file via the `load_time_series_segmentation_benchmark` or `load_human_activity_segmentation_datasets` functions, both of which passed CSV column values directly to Python's `eval()` built-in without validation. An attacker who convinces a data scientist or researcher to open a crafted dataset file can execute arbitrary Python code with the privileges of the running process. No public exploit has been identified at time of analysis, but the upstream fix commit is public and the vulnerability class is trivially replicable given the use of bare `eval()`.
Remote code execution in aeon 1.3.0 is possible when a user loads a maliciously crafted CSV dataset via the `load_human_activity_segmentation_datasets` or `load_time_series_segmentation_benchmark` functions, which pass unvalidated column values directly to Python's `eval()`. An attacker who can deliver a malicious file or dataset URL to a target data scientist can execute arbitrary Python code in the victim's process with their full privileges. No public exploit has been identified at time of analysis, though ZDI (ZDI-CAN-29160) holds technical details; the upstream fix replacing `eval()` with `ast.literal_eval()` is available as a commit but a tagged patched release has not been independently confirmed.
Arbitrary code execution in @cgauge/yaml (all versions ≤ 0.27.0) is achieved by embedding a custom `!js` YAML tag in a document supplied to the parser; the library's tag handler unconditionally passes the tag's string value to `eval()`, granting attackers the full authority of the Node.js runtime - including filesystem access, environment variable exfiltration, network calls, and subprocess spawning. No safe-mode parsing option or opt-out mechanism exists in the library, meaning every call site that parses attacker-controlled YAML is unconditionally vulnerable. A public proof-of-concept exploit is available via GitHub Gist, and no vendor-released patch has been identified at time of analysis.
Code injection in the Query Wrangler WordPress plugin (versions <= 1.5.57) lets an authenticated low-privilege user reach remote code execution on the host. Because the CVSS vector requires only PR:L (subscriber-level access) with a scope change and full CIA impact, any site allowing self-registration is exposed to complete server compromise by its lowest-tier accounts. There is no public exploit identified at time of analysis, but the 9.9 base score and Patchstack attribution mark it as a high-priority patch item.
Prototype pollution in n8n's JavaScript task runner sandbox allows an authenticated user with Code node access to escape VM isolation and execute arbitrary OS commands within the runner container. Affected versions span the v1.x branch before 1.123.69 and the v2.x branch before 2.33.4 and 2.34.1. The corruption is process-wide, meaning a single malicious execution can poison the prototype chain for all subsequent tenant Code node runs on the same shared runner; on v1.x instances without task runner isolation, the attack surface escalates to the main n8n process itself. No public exploit has been identified at time of analysis and CISA KEV does not list this CVE.
Expression injection in n8n's workflow editor allows an authenticated member to store a malicious payload in a resource-locator field that executes as JavaScript in any other user's browser session when they open the affected node. The root cause is that the editor splices the field's stored value directly into the node type's URL template without sanitizing expression syntax, enabling cross-user script execution within authenticated sessions. No public exploit or CISA KEV listing has been identified at time of analysis, but the CVSS 4.0 score of 8.4 reflects high confidentiality and integrity impact on the vulnerable system.
Server-side request forgery and MVG code injection in n8n's Edit Image node allows authenticated low-privilege users to issue blind outbound HTTP requests or read local files by injecting ImageMagick MVG primitives into the Draw Text operation. All n8n versions before 1.123.69 are affected, confirmed by vendor advisory GHSA-233r-fpgw-fx8x. No public exploit identified at time of analysis, but the High confidentiality impact in the CVSS 4.0 vector signals meaningful data exfiltration risk for instances co-located with sensitive internal services or cloud metadata endpoints.
NoSQL injection in n8n's MongoDB integration node (Find, Delete, and Aggregate operations) allows an attacker who can supply externally-controlled data into a workflow query to inject MongoDB operators such as $ne or $where, transforming an intended single-document lookup into full-collection disclosure, mass deletion, or arbitrary database operations. Versions prior to 1.123.69 (v1 branch) and 2.33.4 / 2.34.1 (v2 branch) are affected, per vendor advisory GHSA-953p-jm2c-8h5j. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CVSS 4.0 subsequent-system impact is rated High across confidentiality, integrity, and availability.
Arbitrary PHP code execution in Royal Addons for Elementor WordPress plugin (all versions before 1.7.1066) is reachable by any user holding the manage_options capability, including non-super subsite administrators on WordPress Multisite who would not otherwise have code-execution rights. The plugin writes unsanitized custom widget markup directly to a server-side file that is subsequently executed as PHP, enabling full server-side code injection. A publicly available exploit exists per WPScan; no CISA KEV listing at time of analysis, though the attack scenario is realistic for any WordPress Multisite deployment with delegated administration.
Remote code injection in chenhg5 cc-connect up to version 1.4.1 allows unauthenticated network attackers to execute arbitrary code by manipulating the `exec` argument passed to the `Authenticate` function in `core/webhook.go`. Tagged by reporters as RCE-capable, the vulnerability stems from unsanitized user input reaching a code execution path within the Go webhook handler. A public exploit has been disclosed; no patch has been released, as the upstream GitHub issue was closed automatically due to maintainer inactivity - leaving affected deployments without an official remediation path.
SPL injection in Splunk Enterprise Security versions below 8.6.1 allows low-privileged authenticated users holding the mc_investigation_read capability to inject Search Processing Language through Analyst Queue search filter field names, gaining access to data and system integrity controls available to scheduled search contexts beyond their authorized scope. The root cause is absent validation of filter field names before inclusion in SPL queries - analogous to SQL injection but within Splunk's proprietary query language. No public exploit has been identified at time of analysis and no CISA KEV listing exists, but the CVSS 8.1 High score reflects meaningful confidentiality and integrity exposure for any account holding the relevant capability.
LDAP injection in the AD LDAP app for Splunk SOAR (versions below 2.3.8) allows authenticated low-privileged users to manipulate Active Directory queries, exposing account enumeration, sensitive attribute disclosure, and unintended modification of AD objects. Exploitation requires only a role with 'run actions' permission within Splunk SOAR - no elevated SOAR admin rights needed. Splunk has released a patch (version 2.3.8); no public exploit code or CISA KEV listing has been identified at time of analysis.
Authenticated low-privilege code injection in Splunk Enterprise allows OS command execution on the host system as the Splunk process account. Affected versions span four active release lines (9.4.x, 10.0.x, 10.2.x, 10.4.x), and the root cause is a missing capability check: Splunk Web accepts Splunk Web Manager XML configuration writes without enforcing the edit_manager_xml permission, meaning any authenticated user can plant attacker-controlled content that executes when the Manager page is rendered. No active exploitation is confirmed in CISA KEV, and no public exploit code has been identified at time of analysis, but the CVSS score of 8.8 (High) and straightforward exploitation path make this a high-priority patching target for Splunk deployments.
SPL injection via Analytics Workspace in Splunk Enterprise allows an unauthenticated attacker to execute arbitrary Search Processing Language queries under the permissions of a phished authenticated user. Affected across four release trains - 9.4 below 9.4.14, 10.0 below 10.0.9, 10.2 below 10.2.6, and 10.4 below 10.4.2 - the flaw stems from insufficient input validation when Analytics Workspace constructs searches from URL-embedded data. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, though exploitation impact scales directly with the victim user's Splunk role and data access.
Reflected SPL injection in Splunk Enterprise's Monitoring Console allows an unauthenticated attacker to execute attacker-controlled Search Processing Language commands under the permissions of a phished authenticated victim. Affected versions span four active release trains: 9.4.x below 9.4.14, 10.0.x below 10.0.9, 10.2.x below 10.2.6, and 10.4.x below 10.4.2. No public exploit or CISA KEV listing exists at time of analysis, though successful exploitation grants full read and write access to all data and actions permitted by the victim's Splunk role.
Reflected SPL injection in Splunk Enterprise's Monitoring Console allows an unauthenticated attacker to execute attacker-controlled Search Processing Language queries under the permissions of a targeted Splunk administrator. The attacker must phish an admin-role user into opening a specially crafted link (CVSS UI:R/AC:H), making opportunistic mass exploitation unlikely, but a successful attack can expose all data indexed and accessible to that admin or corrupt lookup tables. Vendor-released patches are available for all affected branches; no public exploit code and no CISA KEV listing have been identified at time of analysis.
Stored SPL injection in Splunk Enterprise allows an unauthenticated attacker who can reach the management port to register a crafted Deployment Server client identity containing malicious Search Processing Language code, which executes when an administrator opens the Add Data forwarder workflow. All four supported major branches are affected (9.4.x, 10.0.x, 10.2.x, 10.4.x), with vendor-confirmed fixes available. No public exploit has been identified at time of analysis, but successful exploitation yields full confidentiality, integrity, and availability impact on the Splunk platform instance.
Remote code execution in Splunk Enterprise allows any authenticated low-privileged user - one without the 'admin' or 'power' role - to inject and execute arbitrary code on the Splunk platform instance via the Splunk Web Manager Configuration REST API endpoint. The root cause is a missing permission check on the REST API path governing manager configuration writes, meaning Splunk evaluates attacker-supplied configuration values without verifying the caller holds the required role. Exploitation yields full confidentiality, integrity, and availability impact on the Splunk instance; no public exploit has been identified at time of analysis.
Remote code execution in Splunk Enterprise allows any authenticated low-privilege user - one who does not hold the 'admin' or 'power' role - to execute arbitrary code by submitting crafted XML content to the Splunk Web Manager Configuration endpoint. The vulnerability combines two weaknesses: server-side evaluation of manager XML expressions without sufficient input restrictions (CWE-94), and a missing capability check on the configuration route that should gate such access. No public exploit has been identified at time of analysis, but the low attack complexity and low privilege requirement make this a high-priority remediation target across Splunk Enterprise 9.4.x, 10.0.x, 10.2.x, and 10.4.x branches.
GitHub Actions workflow injection in Logto's commitlint.yml exposes versions 1.40.1 through 1.41.0 to arbitrary shell command execution on the project's CI/CD runner, triggered by any GitHub user who can submit a pull request with a crafted title containing shell metacharacters. The PR title was directly interpolated into an inline echo command without sanitization, allowing a single-quote character to terminate the shell string and inject attacker-controlled commands into the ephemeral runner environment. Impact is bounded by a read-only GITHUB_TOKEN and absence of exposed repository secrets; no public exploit is identified at time of analysis, and the issue is fully patched in v1.41.0.
IBM PowerVM Hypervisor across firmware branches FW950 through FW1120 exposes a flaw in the hypervisor call (hcall) interface that allows a root-privileged guest partition user to permanently freeze a virtual processor by issuing a specially crafted hypervisor call, requiring a full platform re-IPL to restore operation - a platform-wide denial of service affecting all co-resident guest partitions. In a subset of cases, exploitation may also result in a small amount of data being written into hypervisor or partition memory, creating a limited integrity impact with no attacker-controlled targeting. No public exploit identified at time of analysis; IBM has released a patch via its support portal.
YAML injection in volsync-addon-controller enables a highly privileged, network-capable attacker to break out of YAML value context when annotation values are rendered into OLM Subscription resources, allowing unauthorized modification of OpenShift operator lifecycle configuration. The root cause (CWE-94) is unsanitized interpolation of Kubernetes annotation strings into generated YAML, and the impact includes high integrity and availability consequences for cluster software management. Exploitation is gated behind high-privilege cluster access and the non-default 'volsync-addon-deploy-type: olm' annotation; no public exploit or CISA KEV listing has been identified at time of analysis.
Code injection in marimo before 0.23.15 allows an attacker who can deliver a crafted notebook file to execute arbitrary operating system commands on the victim's machine simply by having the victim open the notebook in edit mode. The vulnerability resides in the notebook configuration handler's MCP (Model Context Protocol) server entry processing: marimo reads attacker-controlled command values from the notebook's configuration and spawns them as local subprocesses before any notebook cell runs, giving the attacker immediate code execution with no further interaction required. No public exploit or CISA KEV listing has been identified at time of analysis, but the CVSS 4.0 score of 8.7 and PR:N vector reflect the low barrier to exploitation once a victim opens a malicious file.
Arbitrary code execution in Orval before 8.21.0 arises when the code generator emits an unescaped backtick (or ${...}) from a Swagger/OpenAPI spec's servers[0].url directly into the JavaScript template literals of generated request and URL-builder functions. Because the malicious spec content breaks out of the template literal, attacker-controlled JavaScript runs the moment the generated client is built or invoked — poisoning developer machines, CI runners, test harnesses, and downstream applications. The flaw only manifests when output.baseUrl.getBaseUrlFromSpecification is enabled; it is fixed in 8.21.0 and, per CVSS 4.0 9.3, no public exploit is identified at time of analysis though a detailed fix commit and regression tests are publicly available.
Arbitrary code execution in Orval (orval-labs/orval) before 8.21.0 allows an attacker who controls an OpenAPI v3 or Swagger v2 specification to run JavaScript in the developer, CI, test, or application environment that generates or imports the resulting client. The flaw lives in the zod schema generator (packages/zod/src/index.ts, formatDefaultValue), which emits a schema default value containing a ${...} interpolation or backtick into a module-level template literal without safe encoding, so the payload is evaluated the moment the generated module is loaded. It is fixed in 8.21.0; there is no public exploit identified at time of analysis and it is not listed in CISA KEV, though the vendor advisory and fixing PR include demonstrative injection payloads.
Code execution in Orval before 8.21.0 occurs when its zod schema generator processes an attacker-controlled OpenAPI v3 or Swagger v2 specification: a ${...} expression or backtick placed in an enum default value is written unescaped into a module-level JavaScript template literal, so simply importing the generated schema module evaluates the attacker's code in the developer, CI, test, or application runtime. This is a CWE-94 code-injection flaw (CVSS 9.3) affecting the packages/zod/src/index.ts formatDefaultValue routine. No CISA KEV listing and no separately published exploit exist at time of analysis, though the vendor's fix commit ships tests containing working injection payloads.
Code injection in Orval before 8.21.0 lets an attacker-controlled OpenAPI v3 / Swagger v2 specification achieve arbitrary code execution: a double-quote character in a query parameter name is written verbatim into the generated request-validation zod.object({...}) schema, so importing that generated module evaluates embedded JavaScript. Any developer workstation, CI runner, test harness, or application that generates a zod client from a malicious or tampered spec is affected. There is no public exploit identified at time of analysis, but the vendor's own fix commit ships tests demonstrating payloads such as require('fs').execSync('id'); it is not listed in CISA KEV and no EPSS score was provided.
Arbitrary code execution in Orval (OpenAPI/Swagger TypeScript client generator) before 8.21.0 lets an attacker who controls an OpenAPI v3 or Swagger v2 specification inject JavaScript that runs when the generated zod schema module is imported. A ${...} template expression or backtick placed in an array item's default value is emitted verbatim into a module-level template literal by formatDefaultValue in packages/zod/src/index.ts, so importing the generated code executes attacker payloads in the developer, CI, test, or application environment. No CISA KEV listing exists, but the fixing PR (#3692) ships tests demonstrating concrete injection payloads such as backtick-plus-require('child_process').execSync('id'), so working exploit technique is effectively public; EPSS was not provided.
Code injection in Orval (orval-labs/orval) before 8.21.0 allows an attacker who controls an OpenAPI v3 or Swagger v2 specification to achieve arbitrary code execution in the environment that generates and imports the client. A double-quote character in a header parameter name is written unescaped into the generated request-validation zod.object({...}) schema, so a crafted spec breaks out of the string literal and injects JavaScript that runs the moment the generated zod module is imported — impacting developer workstations, CI runners, test harnesses, and any application that loads the generated code. It is fixed in 8.21.0; no public standalone exploit or CISA KEV listing exists, though the patch's own test suite includes working injection payloads that demonstrate the vector.
Code injection in Orval, a TypeScript client generator for OpenAPI v3 and Swagger v2 specs, allows arbitrary JavaScript execution when a malicious API specification is processed. In versions prior to 8.21.0, a ${...} interpolation or backtick placed in a header parameter's default value is emitted unescaped into a module-level template literal by the zod schema generator (formatDefaultValue in packages/zod/src/index.ts), so the payload runs the moment the generated schema module is imported in a developer, CI, test, or application environment. No public exploit has been identified at time of analysis, though the fixing PR (#3692) ships proof-of-concept-grade tests demonstrating require('child_process').execSync payloads; the flaw carries a high CVSS 4.0 score of 9.3.
Code injection in Orval before 8.21.0 lets an attacker who controls an OpenAPI v3 or Swagger v2 specification embed executable JavaScript into generated client code. An unescaped backtick (and `${...}` / backslash) in an OpenAPI path, server URL, or server-variable default is emitted verbatim into the template literals Orval generates for axios, fetch, react-query, and SWR clients, so attacker-controlled code runs whenever a generated request, URL-builder, or query-key function is invoked - inside the developer machine, CI pipeline, test suite, or running application. The upstream fix PR and security advisory include demonstrative injection payloads (e.g. `require('child_process').execSync('id')`), so working proof-of-concept exists, but there is no evidence of active exploitation (not in CISA KEV).
Remote code execution in TrueConf Server (versions 5.3.x through 5.3.9, 5.4.x through 5.4.9, 5.5.x through 5.5.5, and earlier) allows an unauthenticated network attacker reaching TCP port 4307 to submit a specially crafted script that escapes the product's isolated/sandboxed execution environment and runs arbitrary code on the underlying host. Reported by Kaspersky ICS-CERT and classified as CWE-94 code injection, the flaw carries a CVSS 4.0 base score of 9.5 driven by full confidentiality, integrity, and availability impact on both the vulnerable component and the host system it breaks out to. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though the sandbox-escape-to-host primitive makes it a high-value target.
Remote code execution in Grav CMS prior to 2.0.7 allows low-privileged page editors to execute arbitrary OS commands as the web server user via a callable-injection flaw in Blueprint::dynamicData(). An account holding admin.pages or api.pages.write permission can embed a malicious data-options@ blueprint directive in page frontmatter that chains through Utils::arrayFilterRecursive() as a trampoline into PHP's system() function, executing the command when the page is rendered. No CISA KEV listing or public exploit code is identified at time of analysis; the full attack technique is documented in GitHub Security Advisory GHSA-fj2p-qj2f-74v5.
Authenticated remote code execution affects Talebook (MyBooks/PoxenStudio) ebook management server versions 3.41.2 and earlier, where an administrator can inject arbitrary Python into the auto-generated auto.py settings module via a crafted SOCIAL_AUTH key name. Because the server imports auto.py as a live module and can auto-restart to reload it, injected statements execute with the service account's privileges, enabling data disclosure, file modification, persistence, or service disruption. No public exploit is identified at time of analysis; the fix is version 3.42.0, and chained authorization/registration weaknesses noted by the vendor could lower the effective privilege barrier.
Remote code execution in ArcadeDB's Gremlin query engine exposes any deployment running arcadedb-gremlin through version 26.7.3 to full OS command execution by any authenticated user, including those with only read-only database roles. The flaw is a silent fallback in ArcadeGremlin.executeStatement() that routes parameterized queries failing gremlin-lang parsing to the unrestricted Groovy scripting engine, which can invoke arbitrary Java and OS-level code as the server process user. No public exploit has been identified at time of analysis, but the minimal privilege bar - any valid credential - makes this a critical upgrade priority for all ArcadeDB deployments.
Config-name injection in GitPython <= 3.1.57 enables arbitrary git-config directive forgery and remote code execution via `core.sshCommand` or `core.hooksPath`. The option-name validator in `git/config.py` only blocks CR/LF/NUL, allowing `=`, `#`, and whitespace to pass unchecked; `write_section` then writes the option name verbatim, causing git to parse attacker-supplied content as a valid directive. Exploitation requires a calling application to forward attacker-influenced input to `config_writer.set_value()` as the option-name argument, and a proof-of-concept is publicly confirmed in the vendor GHSA advisory. No CISA KEV listing is present at time of analysis.
Arbitrary file overwrite in GitPython before 3.1.58 allows attackers who can influence treeish arguments passed to IndexFile.from_tree, IndexFile.reset, or IndexFile.merge_tree to clobber any file writable by the host process with a valid git-index blob. The three affected methods in git/index/base.py forward caller-controlled strings directly to git read-tree with no option sanitization and no -- argument terminator, enabling injection of --index-output=<path>; git's last-occurrence-wins behavior lets the injected flag override the library's internal temp path. A proof-of-concept is publicly documented in GHSA-4gmw-gg2m-w46p; no CISA KEV listing was present at time of analysis.
Pre-authentication PHP code injection in Balbooa Forms, a commercial Joomla form-builder extension, in all versions before 2.4.3.2 lets a remote unauthenticated attacker run arbitrary server-side code. The flaw stems from the optional custom-PHP post-submission handler being executed through eval() after the [URL parameter = X] shortcode is replaced with the raw, unescaped value of an attacker-controlled query parameter. No public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV, but the combination of unauthenticated network reach and full remote code execution makes this a maximum-severity issue wherever a matching handler is configured.
FreeBSD's wg(4) WireGuard kernel driver silently accepts packets bearing invalid Poly1305 authentication tags, completely defeating WireGuard's cryptographic integrity guarantee on affected FreeBSD versions. The driver dispatches decrypt operations to the OpenCrypto Framework (OCF) but never checks the returned MAC verification result, meaning tampered or forged ciphertext passes through as legitimate plaintext. Two distinct attack paths exist: an on-path attacker who can intercept WireGuard UDP traffic can modify ciphertext and authenticated data without detection, while a remote attacker with knowledge of the receiver's replay window bounds can inject forged transport data packets directly. No public exploit has been identified and EPSS sits at 0.18% (8th percentile), indicating no widespread automated exploitation at time of analysis.
Unauthenticated PHP object/global variable injection in the Broken Link Checker WordPress plugin before 2.4.12 allows attackers to overwrite arbitrary PHP global variables via unfiltered query variables on sites using plain permalinks, escalating to remote code execution when a classic (non-block) theme is active. The flaw is reachable by any unauthenticated visitor (CVSS 3.1 base 9.0, PR:N) but requires the AC:H preconditions of plain permalinks plus a classic theme, so it is not universally exploitable. No public exploit has been identified at time of analysis, and the EPSS probability is low (0.22%, 13th percentile), indicating no observed mass exploitation yet.
Sandbox escape leading to host remote code execution in Kobako, a Ruby gem that runs untrusted mruby guest scripts in a WASM sandbox. The transport dispatcher forwarded guest-supplied method names directly to `Object#public_send` on host-bound Service objects without restricting them to the object's own methods, letting a guest pivot through the public `send` into private `Kernel#eval` and execute arbitrary Ruby in the host process. All released versions 0.1.0-0.9.0 are affected; the vendor advisory (GHSA-7pwq-q9jf-539h) documents a working proof-of-concept and CVSS is rated 10.0, though there is no CISA KEV listing or EPSS data provided.
Prompt injection in Context7 through version 2.1.2 allows an attacker with low-level write access to the Custom AI Instructions configuration to plant malicious directives that hijack connected AI coding agents when those agents make routine library documentation requests via the MCP server. The poisoned instructions cause the agent to exfiltrate credentials from environment files (such as .env files containing API keys and tokens) to an attacker-controlled endpoint, and to perform destructive file deletion on the victim developer's machine. No active exploitation has been confirmed in CISA KEV, but no public patch version has been independently verified at time of analysis.
Server-side template injection in GBIF Integrated Publishing Toolkit (IPT) versions before 3.3.4 permits remote low-privileged authenticated attackers to read arbitrary server-side files and access internal application state by injecting template directives into unsanitized user-controlled input. Disclosed by Mandiant (MNDT-2026-0016), the flaw maps to CWE-1336 and carries a CVSS 4.0 score of 7.6 with high confidentiality and integrity impact on the vulnerable system. No confirmed active exploitation or CISA KEV listing exists at time of analysis, but the potential for credential and configuration file exposure makes this a meaningful risk for biodiversity data publishing deployments.
Response header injection in Joomla! CMS download views affects all 3.x releases from 3.0.0 through 5.4.7 and the 6.x branch from 6.0.0 through 6.1.2, enabling a high-privileged attacker to inject arbitrary HTTP response headers into download responses. The missing output sanitization in multiple download view handlers exposes end users to Reflected File Download (RFD) and content-type confusion attacks, where a browser can be tricked into treating a server response as a dangerous executable file. No public exploit code has been identified at time of analysis, and CISA KEV status has not been confirmed.
Remote code execution in MyBB 1.8.13 through 1.8.39 lets an attacker inject arbitrary PHP into the generated database configuration file when the web-based installer (install/index.php) remains accessible. The installer sanitizes database configuration values with addcslashes() but omits the backslash from its escaped-character set, so crafted input can break out of the single-quoted PHP string and execute attacker-controlled code. Rated CVSS 9.8; no public exploit identified at time of analysis, though the fixing commit publicly reveals the exact one-character root cause, lowering the barrier to weaponization.
Mail header injection in MyBB's Email User feature (prior to 1.8.40) allows CRLF sequences embedded in the unsanitized `fromname` HTTP parameter to inject arbitrary SMTP headers - including Bcc, Reply-To, and Return-Path - into outgoing forum emails. The attack surface is conditional on two prerequisites: the `mail_handler` must be set to PHP (the default) and the `cansendemail` group permission must be enabled for the attacker's user group, including guests for the unauthenticated path. No public exploit code exists and this vulnerability is not listed in CISA KEV, but successful exploitation turns the forum's mail infrastructure into a phishing or spam relay, weaponizing the forum's domain reputation against recipients.
Code injection in Vim prior to 9.2.0845 enables arbitrary operating-system command execution by an attacker who can supply a malicious ctags-format tags file. The StructMembers() function in ccomplete.vim embeds typeref: and typename: field values from that tags file into a dynamically constructed vimgrep pattern using escaping that only covers '/' and '\', leaving regex metacharacters such as '[' active; an unclosed bracket breaks Vim's pattern parser, causing the remainder of the tag value to be interpreted as Ex commands where '|' acts as a command separator. Exploitation requires the victim to actively invoke C omni-completion (CTRL-X CTRL-O) while editing a C file referencing the malicious tags entry; no public exploit is identified at time of analysis, though the fix commit's test suite embeds a working proof-of-concept payload, substantially lowering the barrier to weaponization.
Shell command injection in CodeWhale before version 0.8.64 enables arbitrary code execution on a victim developer's machine through a malicious repository config file. By committing a crafted `.codewhale/config.toml` containing `allow_shell = true` to any repository, an attacker can override the tool's shell access controls; when the target developer clones and opens the repository in CodeWhale, the AI agent gains unrestricted access to `exec_shell` and `task_shell` built-in tools and executes arbitrary shell commands without the user's explicit consent. No public exploit has been identified at time of analysis and no CISA KEV listing is confirmed, though the attack mechanics are straightforward and a vendor patch is available.
Remote code execution in CodeWhale (packages codewhale and codewhale-tui) versions 0.8.41 through 0.8.63 allows an attacker to execute arbitrary Python code on the victim's machine by exploiting a hardcoded approval bypass in the rlm_eval built-in tool. The tool's approval_requirement() method returned ApprovalRequirement::Auto, causing the engine to silently skip user approval prompts regardless of the operator's configured --approval-policy, enabling prompt injection attacks through any external content the agent reads. No public exploit has been identified at time of analysis, but the attack surface encompasses any CodeWhale agent workflow that fetches untrusted content such as web pages, repository files, or MCP tool results.
Arbitrary shell command execution in Oh My Zsh's dotenv plugin allows any syntactically valid Zsh command embedded in a `.env` file to run with the victim user's privileges when they `cd` into a directory containing that file. The plugin unconditionally `source`d the `.env` file as a shell script rather than parsing it as a structured key-value store, meaning malicious git repositories, shared project directories, or downloaded archives could weaponize routine developer directory-navigation. Exploitation is silent when `ZSH_DOTENV_PROMPT=false` or when the user presses Enter at the default prompt without reviewing the file; no CISA KEV listing or public exploit code was identified at time of analysis.
Remote code execution in the WP Compress (Image Optimizer) WordPress plugin before version 7.20.01 allows unauthenticated attackers to inject and execute arbitrary PHP code on the underlying web server. Reported by Patchstack (EUVD-2026-60774) and rated CVSS 10.0 with a network, no-privilege, no-interaction vector, this is a maximum-severity flaw affecting every deployment running a vulnerable plugin version. No public exploit identified at time of analysis, though the code-injection root cause and unauthenticated reachability make it a high-priority patch target.
Remote code execution in the Cwicly WordPress page-builder plugin (versions 1.4.4 and earlier) allows a low-privileged Contributor-level account to inject and execute arbitrary PHP code on the server, per a Patchstack advisory. Because a Contributor is a low-trust role often granted for guest posting, this collapses the boundary between content authoring and full server compromise. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV, but the 9.9 CVSS score and CWE-94 code-injection class make it a high-priority patching target.
Server-side template injection in grav-plugin-api before 1.0.15 enables remote code execution for any attacker holding api.pages.write permission. The translate() endpoint accepts unsanitized Twig template syntax in header and content parameters, which can be persisted to a page with process.twig enabled and evaluated by the Twig engine at render time. No public exploit or CISA KEV listing has been identified at time of analysis, but the combination of network-reachable exploitation path and high confidentiality and integrity impact from full server-side template evaluation makes this a serious risk for any Grav installation exposing the plugin API to lower-trust users.
Remote code execution in Grav CMS before 2.0.15 allows attackers holding page-edit or blueprint-config privileges to write arbitrary PHP into web-accessible files and execute it. The flaw lives in the Blueprint dynamic-data 'bare-function' validation, which relies on an incomplete denylist rather than a positive allowlist, letting the error_log function be invoked through a data directive to append attacker-controlled PHP payloads. Reported by VulnCheck; no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Arbitrary code execution is reported in PbootCMS 3.2.15, a PHP-based open-source content management system, reachable through several front-end controllers (MemberController.php, UserController.php, CommentController.php, ContentController.php) and the shared helper.php. Classified as CWE-94 code injection with a CVSS 9.8 and tagged PHP/RCE, it would let an attacker run attacker-supplied PHP on the web server. No public exploit is identified at time of analysis and it is not listed in CISA KEV; note that one of the two primary references is a document titled 'URL Redirection Vulnerability,' which conflicts with the code-execution description and should be verified.
Server-side template injection in JumpServer prior to 4.10.17 enables an authenticated administrator with Applet Host management and deployment permissions to plant Jinja2 expressions in the IP/Host or Core Service Address fields, which Ansible then evaluates as live template expressions during Applet Host deployment, yielding arbitrary OS command execution on the JumpServer control node. The patch was released in v4.10.17, confirmed via the GitHub release tag, and no public exploit code or CISA KEV entry has been identified at time of analysis. Because the control node manages downstream bastion targets, a successful exploit has blast radius well beyond the JumpServer process itself.
Arbitrary Python code execution in FreeCAD's BIM module (versions 0.19 through pre-1.1.1) is triggered when a user opens a malicious project template file through the BIM Project Manager's Load Template function. The loadTemplate() method in BimProjectManager.py passes FCStd metadata fields (wpposition, wpu, wpv, wpaxis) directly to Python's built-in eval(), enabling an attacker who can deliver a crafted template to achieve full code execution under the victim's user account. No public exploit has been identified at time of analysis; the vendor-released patch is confirmed in version 1.1.1.
Arbitrary Python code execution in FreeCAD's BIM Workbench (versions 0.19 through 1.1.0) is triggered when a user creates a TechDraw page from a malicious SVG template, due to an unsafe eval() call in BimTDPage.py at line 87. Exploitation requires social engineering - an attacker must deliver a crafted SVG template to a victim who then performs the TechDraw page creation action. No public exploit has been identified at time of analysis and no CISA KEV listing exists, but the vulnerability is structurally trivial (direct eval of attacker-controlled input, CWE-95) and the fix is available in version 1.1.1.
Remote code execution via crafted .FCStd document in FreeCAD prior to 1.1.2 allows arbitrary Python execution when a victim opens a malicious file. The deserialization path in PropertyPythonObject::Restore() passes attacker-controlled module names directly to PyImport_ImportModule(), executing module-level Python code on import; the legacy pickle branch additionally invokes an attacker-controlled class constructor via PyObject_CallObject(). No public exploit or CISA KEV listing is identified at time of analysis, but exploit construction is straightforward for any researcher who can craft the FCStd XML schema.
Terminal escape sequence injection in powerlevel10k (all versions through 1.20.17) allows any attacker who controls a package.json file on a victim's filesystem to emit arbitrary terminal control sequences on every shell prompt render when the victim navigates into the affected directory. The `prompt_package` segment in `internal/p10k.zsh` passed the `P9K_PACKAGE_VERSION` variable to the terminal without applying Zsh's `(V)` sanitization flag, meaning raw ANSI or OSC escape bytes in the version field reach the terminal emulator unfiltered. No public exploit or CISA KEV listing is identified at time of analysis; the CVSS 4.0 score of 4.8 reflects limited integrity impact and required user interaction.
Unauthenticated data tampering in GitLab CE/EE (18.2-18.11.10, 19.0-19.0.7, 19.1-19.1.5, 19.2-19.2.3) lets a remote attacker modify or delete public projects and user data by abusing a GraphQL directive, per CVE-2026-19478 (CVSS 9.4). The flaw was self-reported by GitLab and publicly available exploit code exists via a HackerOne disclosure, though it is not listed in CISA KEV. Impact is weighted toward integrity and availability rather than data theft (CVSS C:L/I:H/A:H).
Cross-site scripting in Legora before 2026-08-14 allows attackers with content-submission access to execute arbitrary JavaScript in victims' browsers by exploiting an eval() call in the gray-matter JavaScript front-matter parser, which fires before Mermaid SVG sanitization runs. The impact is materially elevated on Word and Outlook add-in surfaces where bearer session tokens are persisted in localStorage, enabling session hijacking beyond the browser context. No public exploit code or active exploitation (CISA KEV) has been identified, though the CVSS 4.0 subsequent-system scores of SC:H and SI:H reflect real-world session-token theft risk in add-in deployments.
Code injection in sqlparse prior to 0.6.0 allows attackers to escape generated Python and PHP source-code snippets by supplying crafted SQL containing backslashes immediately before quote characters, exploiting a missing pre-escaping step in the output formatting filters. The flaw resides in sqlparse/filters/output.py, which escapes quotes without first escaping pre-existing backslashes, causing the generated escape to neutralize the backslash rather than the quote and allowing attacker-controlled content to appear outside the intended string literal as executable code. Publicly available exploit code exists via a validated Docker-based proof-of-concept published in GHSA-3496-9g83-7v6x; no confirmed active exploitation in CISA KEV at time of analysis.
Remote code execution in Regular Labs Sourcerer for Joomla (versions before 14.0.0) allows unauthenticated attackers to inject and execute arbitrary PHP via {source} blocks. The extension parses {source} tags found anywhere in Joomla's final rendered HTML without reliably verifying where that content originated, so attacker-controlled reflected input reaching the page body gets evaluated as trusted code. Rated CVSS 4.0 10.0 (critical); no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Sandbox escape in the openssl_encrypt Python library (jahlives) before 1.4.0 lets attacker-supplied plugin code break out of the IsolatedPluginExecutor and run arbitrary OS commands. The restricted exec() environment still leaks live Python type objects, so an attacker walks the class hierarchy to reach system primitives despite the intended sandbox. Rated CVSS 4.0 9.3 (critical) and reported by VulnCheck; no public exploit identified at time of analysis and it is not listed in CISA KEV.