Python
Monthly
OS command injection in @argos-ci/core <=6.2.0 allows any attacker who can influence a CI pipeline's branch or ref name to execute arbitrary shell commands on the CI runner with the same privileges as the Argos upload process. The vulnerable sink is in packages/core/src/ci-environment/git.ts:89, where execSync() receives an unsanitized branch string interpolated into a template literal passed directly to /bin/sh -c, which evaluates $() command substitution and other metacharacters before spawning git. A fully working proof-of-concept exploit exists (GHSA-4x45-gxvp-6283) and the attack surface is widened by the fact that hasRemoteContentAccess: false - the configuration that triggers the vulnerable code path - is the default for projects without a connected Git provider integration.
Arbitrary Python code execution in IBM Langflow OSS 1.0.0-1.11.5 is possible for any authenticated low-privileged user by embedding malicious code in custom components within stored flows. The root cause is a missing server-side authorization check (CWE-862) - the platform executes custom Python component logic without verifying whether the caller has sufficient privileges to run arbitrary code, not a failure to authenticate them. IBM has released a patch via support advisory 7286666; no public exploit or CISA KEV listing has been identified at time of analysis.
Path traversal in @openhop/server (npm, versions ≤0.3.5) allows unauthenticated remote attackers to read or permanently delete arbitrary `.yaml` files accessible to the OpenHop process outside its configured flow data directory. The root cause is that `FlowStore.filePath()` passes caller-supplied HTTP route parameters directly to Node.js `path.join()` without any sanitization or allowlist validation, and Fastify's underlying `find-my-way` router URL-decodes the parameter before it reaches application code, enabling `..%2F`-encoded directory traversal. A fully functional PoC is publicly available with Docker-based reproduction steps; no KEV listing at time of analysis. Docker deployments expose the server on all interfaces by default, enabling direct network exploitation without user interaction.
Unauthenticated LAN access to the ESPHome Device Builder dashboard on Home Assistant add-on deployments allows any device on the local network to gain host-equivalent control with no credentials. The ingress site, which deliberately skips authentication because the HA supervisor is supposed to authenticate upstream, was bound to 0.0.0.0 instead of loopback and the supervisor gateway. Because the add-on uses host networking for mDNS, this exposed the no-auth site on the host's LAN interface, directly bypassing the supervisor's authentication layer. An attacker with LAN access can run arbitrary Python via external_components at compile time, execute arbitrary shell through compile/validation subprocesses, and read or write arbitrary files in the config and data directories. No public exploit has been identified at time of analysis.
Remote code execution in functype-mcp-server 1.4.3 and earlier allows any MCP client - including an LLM agent manipulated via prompt injection - to execute arbitrary JavaScript in the server process by invoking the `set_functype_version` tool with a `file:`, `git+`, or URL package-alias as the version string. The server interpolates the unsanitized input directly into a `pnpm add` specifier, installs the attacker-controlled package as the `functype` alias, then immediately dynamic-imports `functype/cli` from the poisoned location, running module-level attacker code with full MCP server process privileges. A fully automated Docker-based proof-of-concept confirming end-to-end RCE is documented in GHSA-wcjj-9m6g-2fr2; no public exploitation has been confirmed (not in CISA KEV), and a patched version 1.4.4 is available.
nuxt-ollama versions 1.2.26 through 1.3.0 unconditionally places the Ollama cloud API key into Nuxt's public runtime config, causing it to appear verbatim in every server-rendered HTML page inside the `window.__NUXT__` script block, readable by any unauthenticated HTTP client. Any visitor or web crawler that fetches any page of an affected application can extract the `api_key` from the serialized SSR payload with a single GET request, then impersonate the operator against the Ollama cloud API to incur billing charges, exhaust rate limits, or exfiltrate stored model data. A publicly available PoC using Docker and Python has dynamically confirmed the leak; no public exploit identified at time of analysis for active KEV-level exploitation.
Server-side request forgery in Open WebUI prior to 0.11.1 allows authenticated users to reach internal cloud infrastructure by exploiting gaps in Python's `is_global` address classification. The web retrieval endpoints POST /api/v1/retrieval/process/web and /process/web/search relied solely on Python's built-in global-address check, which does not reject the Azure platform channel IP (168.63.129.16) or other reserved ranges such as multicast, 6to4 relay, NAT64, IPv6 site-local, and embedded-IPv4 representations. On Azure-hosted deployments this enables exfiltration of platform metadata, certificates, and management tokens accessible via the wire-link channel. No public exploit identified at time of analysis; vendor-released patch exists as version 0.11.1.
DNS rebinding SSRF in Open WebUI versions 0.9.6 through 0.11.0 allows authenticated users who control authoritative DNS to bypass hostname validation in SafePlaywrightURLLoader and reach internal services or cloud metadata endpoints. The flaw exists because Python validates the resolved hostname at check time, then the Playwright browser independently re-resolves the same hostname at use time - enabling an attacker to serve a public IP during validation and a private or link-local IP for the actual fetch. The issue is fixed in v0.11.1 by routing all fetches through the SSRF-safe requests session, eliminating the second resolution. No public exploit code or CISA KEV listing is present.
Remote code execution via unsafe Python pickle deserialization in the community.general Ansible collection's memcached fact cache plugin gives unauthenticated network-adjacent attackers full control of the Ansible controller. Despite documenting JSON as its storage format, the plugin delegates serialization entirely to python-memcached, which transparently pickles Python objects on write and unpickles them on read - a format that executes arbitrary Python code during deserialization. Because memcached has no native authentication and Ansible fact cache keys are derived from predictable hostnames, any attacker who can write to the target memcached instance can inject a malicious payload that executes when the controller next reads cached facts. No public exploit or CISA KEV entry has been identified at time of analysis.
Remote code execution in Google Cloud Agent Development Kit (ADK) for Python versions 2.0.0 through 2.6.0 allows an unauthenticated remote attacker to run arbitrary code on the host by submitting a crafted test session replay to the 'adk web' developer interface when the pytest package is present. The flaw stems from an incomplete input-restriction check (CWE-184) that lets malicious replay content reach code execution. No public exploit has been identified at time of analysis, but the vendor rates it CVSS 10.0 and shipped a fix in v2.7.0.
Double-free memory corruption in libxml2's SAX parser Python bindings allows a remote attacker to crash Python applications by supplying XML documents with DTD-defined enumerated attribute values, triggering a use-after-free in the attributeDecl callback. The vulnerability (CWE-763) is confirmed by Red Hat and affects all major RHEL versions (6 through 10) as well as Red Hat OpenShift Container Platform 4 and Hardened Images. While the confirmed impact is a reproducible denial of service, the Red Hat-provided CVSS vector (C:H/I:H/A:H with scope change) signals that Red Hat assesses the double-free as carrying latent code-execution potential beyond the confirmed crash. No public exploit and no KEV listing exist at time of analysis.
Remote code execution in Axolotl through 0.18.0 allows an attacker who controls a Hugging Face model repository to execute arbitrary Python code on any machine running an Axolotl training job with multipack patches enabled. The root cause is a logic flaw in `_apply_multipack_patches()`: when a user has not explicitly set `trust_remote_code` in their YAML config (leaving it as Python `None`), the guard condition `self.cfg.trust_remote_code is not None` evaluates to `False`, skipping the override assignment and leaving `has_remote_code=True` from the model's own metadata claim. Downstream code in `multipack.py` then calls `AutoModelForCausalLM.from_pretrained` with `trust_remote_code=True` hardcoded, executing whatever Python the model repository supplies. No public exploit is identified at time of analysis, but the attack surface is broad for teams running automated fine-tuning pipelines that source models from HuggingFace without explicit config hardening.
Remote code execution in LaVague 0.2.35, an LLM-driven web-automation agent framework, arises because PythonFromMarkdownExtractor.extract_as_object evaluates language-model output that is derived from attacker-influenced web page content. An attacker who controls or poisons a page the agent visits can use indirect prompt injection to coerce the model into emitting Python that is then eval'd and executed on the operator's host with no human review. Reported by VulnCheck (CWE-94); no public exploit identified at time of analysis and it is not listed in CISA KEV.
Path traversal in Google Cloud Agent Development Kit (ADK) Python versions 1.9.0 through 1.21.0 exposes arbitrary server files to unauthenticated remote attackers via a crafted `file_path` query parameter on the builder endpoint. The root cause, confirmed by the upstream commit diff, is that `fast_api.py` passed the user-supplied path directly into filesystem operations without sanitization or boundary enforcement, allowing `../` sequences to escape the agents directory. No public exploit code or active exploitation has been identified; vendor-released fix is available in v1.22.0.
Improper OCSP response validation across the Snowflake Python, Go, JDBC, and Node.js drivers allowed a revoked TLS certificate to be treated as valid, enabling a man-in-the-middle attacker to intercept and tamper with driver-to-Snowflake TLS sessions. The root flaw is twofold: OCSP stapled or fetched responses were not reliably bound to the specific certificate under validation, and definitive OCSP verification failures were treated as transient errors (soft-fail), causing the driver to proceed with a connection rather than abort it. Exploitation requires a network-adjacent or on-path position combined with possession of a revoked certificate and its corresponding private key for a Snowflake or storage-stage hostname; no public exploit is identified at time of analysis and EPSS data was not provided, but the CVSS AC:H reflects these steep prerequisites.
Token forgery in python-jose through 3.5.0 lets an attacker who possesses the service's asymmetric public key mint valid HS256 (HMAC) JWTs, because the library's HMAC key initialization accepts DER-encoded public keys that lack PEM armor or SSH prefixes and never rejects them as asymmetric material. This is a classic JWT algorithm-confusion (RSA/EC-to-HMAC) attack that succeeds whenever the verifying application does not explicitly restrict the accepted algorithms, and it represents an incomplete fix for CVE-2024-33663. There is no public exploit identified at time of analysis, though the technique is well-documented and the same class of flaw has prior public tooling.
Server-side request forgery in OpenStack Glance 16.0.0 through 32.0.0 allows authenticated tenant users to make the image service fetch arbitrary internal URLs, including cloud metadata endpoints at 169.254.169.254, turning the image import pipeline into a full-read SSRF channel. Three related flaws (CVE-2026-71196, CVE-2026-71197, CVE-2026-71198) stem from insecure default host filtering in the web-download import method, a DNS rebinding bypass that evades the validator, and absent host filtering in the HTTP image location API respectively. Because Glance stores fetched bytes as downloadable image data, none of these are blind SSRF - the full response body is directly retrievable by the attacker. No public exploit has been identified, but the cloud-credential-theft impact warrants urgent remediation in any multi-tenant or internet-facing OpenStack deployment.
DNS rebinding bypass in OpenStack Glance's web-download URI validator allows authenticated tenant users to circumvent host-filter restrictions and force the image service to fetch arbitrary internal URLs, enabling full-read SSRF exfiltration via the image download API. The validator evaluates host filters against the raw pre-resolution hostname, creating a TOCTOU window: an attacker's domain passes the check resolving to a legitimate external IP, then DNS rebinding redirects the actual fetch to internal targets such as the cloud instance metadata service at 169.254.169.254. Glance versions 16.0.0 through 30.2.0, 31.0.0 through 31.1.0, and 32.0.0 are affected; no public exploit has been identified at time of analysis.
Full-read server-side request forgery in OpenStack Glance's HTTP image location API allows authenticated tenant users to exfiltrate arbitrary internal network resources, including cloud metadata endpoints, when the HTTP store backend is enabled. Unlike a typical blind SSRF, Glance stores the fetched content as image payload that the attacker can then download in full, making credential theft from the instance metadata service (169.254.169.254) directly achievable. CVE-2026-71198 is one of three coordinated SSRF issues (OSSA-2026-038) reported independently by Sergey Kanibor, Sami Yessou, and Abhishek Kekane; this specific variant was credited to Kekane of Red Hat.
Unauthenticated cross-origin RCE in Windows ML CLI (winml-cli < 0.4.0) is reachable when a developer runs the `serve` command, which exposes a localhost HTTP API with a wildcard CORS policy and no authentication gate. Any malicious webpage visited by the user while the server is running can send cross-origin requests to `/v1/cli/build` or `/v1/cli/config`, inject `trust_remote_code=true`, and cause the server to call `AutoConfig.from_pretrained(trust_remote_code=True)` - downloading and executing attacker-controlled Python code from a remote model repository as the server user. The vendor has released a fix in version 0.4.0; no public exploit is identified at time of analysis.
Memory exhaustion via unbounded decompression in HTTPX2 (all versions before 2.12.0) allows any HTTP server the client contacts to cause severe memory pressure or out-of-memory process termination by returning a crafted compressed response body. The content decoders in `_decoders.py` call `decompress()` without a size cap, so a single 64 KiB compressed chunk can inflate to approximately 64 MiB in one allocation across gzip, deflate, brotli, and zstd encodings - all enabled by default. No active exploitation is confirmed in CISA KEV, and no public proof-of-concept is referenced, but the decompression-bomb technique is well understood and trivially reproducible.
HTTPX2's SOCKS5 proxy implementation omits TLS negotiation for WebSocket Secure (wss://) origins, exposing the full WebSocket session - opening handshake, query parameters, Authorization headers, cookies, and message frames - in plaintext to anyone who can observe or control the proxy path. Affected are applications using Client.websocket() or AsyncClient.websocket() in HTTPX2 versions 2.6.0 through 2.9.1 when routing through a SOCKS5 proxy. An adjacent-network attacker can passively eavesdrop on or actively modify traffic, and can impersonate the WebSocket server due to the missing certificate verification step. No public exploit code has been identified at time of analysis and this CVE does not appear in the CISA KEV catalog.
Python bytecode scanning gap in agentverus-scanner allows supply-chain attackers to smuggle malicious __pycache__ .pyc files past the tool's static and semantic analysis engines, which only inspect source .py files in companion code directories. Packages carrying malicious bytecode alongside benign source receive a CERTIFIED verdict with elevated trust scores, causing downstream environments that trust the scanner to silently execute attacker-controlled code on import. No public exploit code has been identified at time of analysis, but the VulnCheck advisory and GitHub issue #27 document the bypass technique in sufficient detail for reproduction.
Incomplete file coverage in claude-skill-antivirus v2.1.3 allows malicious Claude skill packages to bypass security scanning entirely when installed from local directories. The scanner reads only the SKILL.md manifest file, leaving Python source (.py), bytecode (.pyc), and all other executable artifacts in the scripts/ subdirectory completely unanalyzed. Skill authors can embed arbitrary malicious payloads in non-manifest files and receive a SAFE verdict with a perfect 100/100 trust score, providing users with false assurance before installation.
Tencent AI-Infra-Guard's skill-scan component allows scanner bypass via hardcoded exclusion of Python compiled bytecode, enabling malicious skill packages to pass a false SAFE verdict and execute arbitrary code on operator hosts. Attackers supply a skill with benign `.py` source decoys alongside malicious `.pyc/.pyo/.pyd` bytecode in `__pycache__` directories; because three separate scanning surfaces in versions through v4.6.0 unconditionally skip these artifacts, the auditing LLM never sees the malicious payload. CPython's PEP 552 UNCHECKED_HASH behavior executes `.pyc` at import time regardless of source presence, triggering code execution when an operator installs the skill. No public exploit identified at time of analysis, but the upstream fix commit and GitHub Issue #531 confirm the flaw.
Scrapy's S3DownloadHandler transmitted s3:// requests - including signed AWS Authorization headers, temporary session tokens, and full S3 object contents - over plaintext HTTP by default in all versions prior to 2.17.0, exposing credentials and data to any network attacker with a man-in-the-middle position. A passive observer on the network path can harvest AWS credentials silently; an active attacker can modify S3 response bodies, status codes, and headers to poison scraped data exports, corrupt HTTP caches, or manipulate subsequent crawl targets through forged redirects. The root cause is a logic inversion in a single line of s3.py: HTTPS was opt-in rather than opt-out. No public exploit has been identified at time of analysis, and a patched release (2.17.0) is confirmed available.
Cleartext HMAC key exposure in Amazon SageMaker Python SDK's @step and @remote decorator components (versions before v2.256.0 and v3.11.0) lets any authenticated IAM principal within the same AWS account read the signing key from DescribePipeline API responses, then forge valid integrity signatures to inject attacker-controlled code into a victim user's pipeline execution context. No public exploit has been identified and the vulnerability is absent from the CISA KEV catalog, but the attack chain is mechanically straightforward for any account member holding the sagemaker:DescribePipeline permission. Vendor-released patches for both SDK branches are confirmed via GitHub release tags v2.256.0 and v3.11.0 and AWS Security Bulletin 2026-093-aws.
Unsafe PyYAML deserialization in ModelScope through v1.40.0 enables remote code execution when users load model configuration files from attacker-controlled repositories. The vulnerability exists in at least two documented components - the audio TTS voice module (voice.py) and the multimodal mPLUG configuration loader (configuration_mplug.py) - which use PyYAML's unsafe yaml.Loader that processes Python object construction tags such as !!python/object: during deserialization. An attacker who publishes a poisoned model repository can achieve full code execution on any victim system that loads the model, with no public exploit identified at time of analysis.
Write-before-consent in Hugging Face Transformers' GenerativePreTrainedModel.load_custom_generate() allows attacker-controlled Python files to be silently written to ~/.cache/huggingface/modules/ even when the user declines the trust prompt. Affected versions span 4.49.0 through 5.8.1. While immediate execution is blocked by the trust gate, the persisted cache file creates a stale-cache collision risk: subsequent loads of unrelated trusted models may inadvertently execute the previously cached, attacker-supplied Python code. No public exploit has been identified at time of analysis.
Remote code execution in lllyasviel Fooocus 2.1.854 through 2.5.5 allows any user who can upload an image to execute arbitrary Python code on the hosting server. The vulnerability stems from the `get_list` function in `modules/meta_parser.py` passing a `styles` field extracted from image EXIF metadata directly to Python's `eval()` without sanitization or sandboxing. A detailed technical writeup exists at mrbruh.com/fooocus and the vulnerable code path is publicly visible in the repository; no confirmed active exploitation has been identified at time of analysis, and EPSS stands at 0.24% (15th percentile).
Denial-of-service in Tornado prior to 6.5.8 allows unauthenticated remote attackers to stall the entire server by sending a single POST request with millions of separator-delimited fields in an application/x-www-form-urlencoded body. Because Tornado's RequestHandler parses the body synchronously before handler dispatch using urllib.parse.parse_qs without a max_num_fields limit, a request body up to the 100 MB default max_buffer_size can consume all CPU on the single-threaded event loop and delay every concurrent connection. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity (AV:N/AC:L/PR:N/UI:N) makes this trivially automatable against any exposed Tornado endpoint.
Out-of-bounds read in Exiv2's CrwMap::decodeBasic() function affects versions prior to 0.28.9, impacting applications that use the library to parse Canon CRW image metadata. Classified as low severity by the Exiv2 maintainers, this flaw has only been reproduced using a dedicated fuzz target - the standard exiv2 command-line tool cannot trigger it under normal operation. No public exploit exists and no active exploitation has been identified, making real-world impact minimal despite the memory safety class of defect.
Out-of-bounds write in Exiv2's RemoteIo::Impl::populateBlocks() affects all versions prior to 0.28.9, exploitable only when Exiv2 is invoked with a remote URL as input rather than a local file path. Memory corruption from the write could theoretically enable code execution in the Exiv2 process context if a user or automated pipeline fetches a specially crafted image from an attacker-controlled server. Fixed in the 0.28.9 release; no public exploit or KEV listing identified at time of analysis.
Authentication denial of service in free5GC AUSF v1.4.4 and current main allows an attacker with access to the AUSF SBI/N12 interface to permanently block a target subscriber from completing 5G authentication by flooding the AUSF with concurrent POST /nausf-auth/v1/ue-authentications requests for the same SUPI. Each concurrent request silently overwrites the active EAP-AKA' session context stored under that SUPI key, so the legitimate UE's EAP response is validated against mismatched cryptographic material (K_aut, XRES) and fails AT_MAC verification. No vendor patch has been released; a working proof-of-concept was reproduced in a controlled lab and is documented in the upstream GHSA advisory, with no CISA KEV listing identified at time of analysis.
Exponential backtracking ReDoS in Protego (pip/protego <= 0.6.1) allows any party who can serve a crafted robots.txt to freeze the `can_fetch()` call indefinitely, denying service to any application using this library for robots.txt compliance. A working proof-of-concept is publicly available in the GitHub security advisory GHSA-wjmf-p669-5m5p; the CVSS 4.0 score of 7.1 (VA:H) reflects meaningful availability risk for web-crawling deployments. No public exploit identified at time of analysis beyond the published PoC, and no CISA KEV listing exists.
Privilege escalation in piccolo_admin 1.13.0 and earlier allows any non-superuser admin to permanently elevate to superuser by exploiting a two-flaw chain: the `superuser_validators` access-control function uses a deny-list that omits GET, and the `SessionsBase.token` column is stored as plaintext Varchar without `secret=True`, causing it to appear in every GET /api/tables/sessions/ response. An authenticated low-privilege admin can harvest the superuser's live session token in a single unauthenticated-to-superuser GET request, replay it to issue a PATCH that sets `superuser=true` on their own row, and permanently retain elevated access - the stolen cookie is then discarded. A publicly available proof-of-concept with full reproduction steps was included in the GitHub security advisory (GHSA-2gh4-jmwq-rr8w); no CISA KEV listing is present at time of analysis.
Blind SQL injection in WsgiDAV's MySQLBrowserProvider sample module (versions <= 4.3.4) allows unauthenticated network attackers to read arbitrary data from the backing MySQL database via URL path manipulation. The record key segment of the URL is concatenated directly into a WHERE clause without escaping, enabling a boolean status-code oracle that supports full character-by-character data extraction. A secondary typo in the numeric-type check (`INTT` instead of `INT`) ensures all primary key types take the vulnerable quoted branch, and a working PoC with complete extraction script has been publicly confirmed. No public exploit identified as confirmed actively exploited (CISA KEV), but the PoC lowers the exploitation bar significantly.
Cross-project Kanban data destruction in Vikunja allows any authenticated user to permanently wipe `task_buckets` and `task_positions` for any project view in the entire instance, regardless of project membership. Affecting versions 0.24.6 through 2.4.0, the `ProjectView.Delete` method performs two unscoped cascading SQL deletes using only the URL-supplied view ID after an authorization check that verifies admin rights on the attacker's own project - never confirming the target view belongs to that project. A working PoC is publicly available via the GHSA advisory; view IDs are auto-increment integers, making full-instance enumeration trivial with no prior reconnaissance.
Remote code execution in BISHENG's workflow engine (versions before 2.6.0) allows any authenticated user to submit crafted Code node definitions to the POST /api/v1/workflow/run_once endpoint, where they are evaluated via Python's exec() built-in without sandboxing or process isolation. Successful exploitation grants full server-side code execution with access to the host filesystem, stored credentials, and internal network resources reachable from the BISHENG backend process. No public exploit or CISA KEV listing has been identified at time of analysis, but the low-complexity, authenticated network attack path represents a critical risk especially in multi-tenant or shared-access deployments.
Arbitrary code execution in SpeechBrain before v1.1.1 is triggered during checkpoint candidate enumeration when PyYAML's unsafe loader parses attacker-controlled CKPT.yaml files in the configured checkpoint path. An attacker who can plant a crafted CKPT.yaml - for example via a malicious pretrained model distributed through a public model repository - can embed !!python/object/apply YAML tags that cause Python to instantiate arbitrary objects at parse time, achieving code execution before any checkpoint is ever selected for recovery. No public exploit specific to this CVE has been identified at time of analysis, and it is not listed in the CISA KEV catalog, but the underlying PyYAML unsafe deserialization class is extensively documented and exploit techniques are widely known.
Unauthenticated remote code execution affects mims-harvard ToolUniverse through 1.2.6, where the python_code_executor tool runs caller-supplied Python in a sandbox that can be escaped and the HTTP/MCP servers listen on all interfaces with no authentication. Any attacker who can reach the exposed port executes arbitrary code as the server process, since the deny-list source inspection can be bypassed via dunder attribute traversal and a per-call flag that widens the import allow-list. No public exploit code is identified at time of analysis, but the flaw is reported by VulnCheck and carries a CVSS 4.0 base score of 9.3; it is fixed in version 1.3.0.
Remote code execution in Flowintel's alerts settings update endpoint (versions >= 3.3.0) allows an authenticated high-privileged attacker to inject arbitrary Python statements into the application's live configuration module. The vulnerable endpoint in app/alerts/alerts.py interpolated attacker-supplied configuration keys directly into Python source written to conf/config_module.py, then triggered importlib.reload() - executing injected code in the server process. No public exploit has been identified and the vulnerability is not listed in CISA KEV, but successful exploitation yields full server-side code execution with the privileges of the Flowintel process.
Frappe's REST API before v15.115.0 contains an access control bypass (CWE-863) that allows any low-privileged authenticated user to read fields from Linked DocType records outside their permitted scope. When a document is fetched via the REST API, the framework resolves Link field references to other DocTypes but inconsistently re-applies the linked DocType's own permission rules, enabling horizontal data leakage across role boundaries. No confirmed active exploitation or public exploit code has been identified, but the low attack complexity and network-accessible vector create meaningful data exfiltration risk in multi-role or multi-tenant Frappe/ERPNext deployments.
Code injection in whichllm's run and snippet CLI commands allows a network-positioned attacker who controls a HuggingFace repository to achieve full arbitrary code execution on any victim's machine by publishing a repository containing a crafted GGUF filename with Python metacharacters. The script generation function in cli.py interpolates the HuggingFace Hub API siblings rfilename field directly into dynamically generated Python source without escaping, enabling a string-literal breakout that fires injected code before any model download occurs. No active exploitation is confirmed in CISA KEV and no public proof-of-concept is referenced; vendor-released patch v0.5.16 is available and directly remediates the root cause.
Unauthenticated remote code execution in SENAITE.CORE (senaite.core) 2.0.0 through 2.6.0 lets any network-reachable attacker run arbitrary Python in the Zope worker process by chaining a missing authorization check with an eval() sink in the JSON API. The anonymous-reachable /@@API/update route calls eval() on attacker-supplied RecordsField/RecordField values before any permission or write check fires, and a public working PoC (tested against the stock senaite/senaite:v2.6.0 Docker image) demonstrates credential-free command execution. Publicly available exploit code exists; the flaw is not listed in CISA KEV, so there is no confirmation of active exploitation.
Remote code execution in Google langfun before 0.1.2 arises because the default lf.query Python protocol evaluates model-generated Python expressions with no sandbox, letting remote unauthenticated attackers run arbitrary code in the host application by supplying crafted prompt inputs that steer the model into emitting executable code. Because langfun embeds directly in LLM-driven Python applications, any deployment that pipes untrusted prompt content through lf.query is exposed. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the CVSS 4.0 base score of 9.2 (CRITICAL) reflects full confidentiality, integrity, and availability impact.
ReDoS in NLTK's tgrep module exposes applications to indefinite CPU saturation when user-controlled tgrep patterns containing /regex/ nodes reach the _tgrep_node_action function, which compiles and executes them via Python's re.search without validation or timeout. All NLTK versions before 3.10.3 are affected when tgrep_positions() or tgrep_compile() accept external input. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; exploitation is conditional on a non-default, externally-exposed API configuration.
Catastrophic regex backtracking in NLTK before 3.10.0 allows unauthenticated remote attackers to saturate CPU and deny service to all users sharing the Python process by supplying crafted patterns to the Text.findall() or TokenSearcher.findall() methods. Any Python application that exposes NLTK regex search functionality to user-controlled input is affected across all platforms. No public exploit has been identified at time of analysis, but the vulnerability class (ReDoS) is well-understood and trivial to weaponize once the targeted endpoint is known.
Arbitrary file write and directory deletion in compliance-trestle's catalog-generate, profile-generate, and ssp-generate author commands exposes CI/CD pipelines to workspace-escape attacks when output arguments are derived from untrusted data. The affected commands construct output paths by joining a user-supplied argument onto the Trestle workspace root, but apply only a task-name-collision check rather than the PathSecurityValidator guard already used by the jinja command - allowing absolute paths or traversal sequences to escape the workspace entirely. With --force-overwrite, the primitive escalates to recursive deletion of an attacker-chosen directory tree followed by file creation, enabling indirect code execution by overwriting files (e.g., .github/workflows, .git/hooks, shell profile scripts) that a downstream pipeline subsequently executes. No public exploit is identified at time of analysis, though the GHSA advisory for the related jinja variant (GHSA-4q5v-7g7x-j79w) contains a detailed reproduction procedure.
Server-side template injection in Compliance-Trestle's custom Jinja2 include tags (`mdsection_include` and `md_clean_include`) allows a low-privileged local attacker to achieve arbitrary code execution when attacker-controlled OSCAL data containing Jinja2 syntax is processed during template rendering. All versions prior to 3.12.4 and the 4.0.0-4.0.3 line are affected; the fix is version 4.1.0. No CISA KEV listing or standalone public exploit has been identified at time of analysis, though security test payloads demonstrating the RCE gadget chain are present in the upstream fix commits.
Server-side template injection in compliance-trestle's custom Jinja2 tags enables remote code execution when the tool processes attacker-controlled Markdown or YAML content. Versions before 3.12.4 and the 4.0.x series through 4.0.3 are affected; the root flaw is that MDCleanInclude and MDSectionInclude re-parse included content using a non-sandboxed jinja2.Environment, allowing injected expressions to traverse Python object internals and invoke arbitrary OS commands as the Trestle process user. No public exploit or CISA KEV listing has been identified at time of analysis, but the attack surface is realistic in supply-chain workflows where users import third-party SSP or YAML documents.
Worker-thread exhaustion in Mesop's debug-mode hot-reload endpoint (prior to version 1.3.3) allows an unauthenticated remote attacker to render the server completely unavailable with minimal effort. The GET /hot-reload endpoint in debug mode enters an unbounded loop controlled by the attacker-supplied counter parameter, holding worker threads indefinitely until the thread pool is exhausted and the server stops responding to all requests. Recovery requires a manual server restart. No public exploit has been identified at time of analysis, but the attack mechanism is trivially simple and fully automatable.
Unauthenticated arbitrary file write in DB-GPT 0.8.0 lets remote attackers achieve remote code execution through the skill_upload endpoint, which builds an upload path by joining the user-controlled multipart filename to the upload directory without canonicalisation or containment checks. Because the route's only auth dependency (get_user_from_headers) returns an admin-role request even when no credentials are supplied, an attacker with no account can write a .py file such as ../../../tmp/x or /tmp/x anywhere the server process can write, then plant or overwrite a Python module that executes when next imported. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV, but the flaw is trivially exploitable and fixed in v0.8.1.
Unauthenticated remote code execution in Chainlit (2.4.0rc0 through 2.11.x) occurs when features.mcp.enabled is set to true, exposing the POST /mcp endpoint that accepts a user-controlled stdio command string. Because the allowlist only validates the executable name and passes arguments unchecked, an attacker can supply 'npx -y -c <payload>' to run arbitrary shell commands as the Chainlit process. Publicly available exploit code exists (working PoC from the reporting researchers and in the advisory); it is not listed in CISA KEV, and MCP has been disabled by default since v2.7.0, limiting the exposed population.
Remote code execution in Amazon Strands Agents Tools before 0.8.5 lets an attacker abuse the python_repl tool to run arbitrary Python on the agent's host by defeating its human-in-the-loop consent gate. A crafted prompt smuggles the non_interactive_mode flag as a keyword argument through the batch tool, causing python_repl to execute without operator approval. No public exploit has been identified at time of analysis, but the CVSS 4.0 base score is 9.2 (Critical) given full confidentiality, integrity, and availability impact on the host.
CPU exhaustion denial-of-service in eml_parser (Python pip package, versions prior to 3.0.2) stems from a quadratic-time regex fix-point loop in the `noparenthesis` function used to strip parenthesized CFWS comments from `Received:` email headers. Remote, unauthenticated attackers can submit small, specially crafted EML files containing deeply nested parentheses that consume multiple seconds of CPU time per parsed message, degrading throughput and causing queue backpressure or service-level outages in synchronous email gateways, sandboxes, and real-time triage pipelines. No public exploit has been identified at time of analysis, but the attack is trivially reproducible from first principles using only the published advisory description.
Remote code execution in qwed 5.1.1 allows any authenticated tenant to execute arbitrary Python code inside the API server process by submitting crafted mathematical expressions to the POST /verify/math or POST /verify/batch endpoints. User accounts are freely self-registerable via the default-enabled /auth/signup endpoint - no invitation code or administrator approval required - making the effective exploitation barrier nearly equivalent to unauthenticated. A complete, functional proof-of-concept exploit script is publicly available in the GitHub advisory (GHSA-q27q-98j4-9pfv), and a vendor-released patch is available in version 5.1.2.
Authentication bypass in djust's WebSocket LiveView consumer allows unauthenticated remote clients to invoke protected event handlers on views gated by login_required, permission_required, or redirecting on_mount hooks. All djust versions prior to 1.0.4 are affected: handle_mount sends a navigate/redirect frame on auth denial but neither closes the WebSocket nor clears self.view_instance, leaving the socket open and exploitable. Because handle_event never rechecks authentication after mount, a non-browser WebSocket client that ignores the redirect can send arbitrary event frames and execute state-mutating or data-reading handlers without an authenticated session. No public exploit identified at time of analysis beyond the WebsocketCommunicator proof-of-concept reproducer disclosed in GHSA-xx4j-w367-7247; this vulnerability is not listed in CISA KEV.
Arbitrary OS command execution in mcp-shell's default Docker image allows any MCP tool caller to bypass the secure-mode executable allowlist by supplying `/bin/bash -c <payload>` to the `shell_exec` tool, running commands as `mcpuser` (UID 1000) inside the container. The validator in `security.go` extracts only the first whitespace-delimited token as the executable, approves `/bin/bash` against the default allowlist, and passes the `-c` flag through the metacharacter check unchallenged because the default `blocked_patterns` array is empty. A fully working PoC is included in the GitHub Security Advisory GHSA-3x77-wg38-92r3; no public exploit identified at time of analysis beyond the researcher-provided PoC, and no CISA KEV listing exists. Vendor-released patch v0.6.0 is confirmed.
OS command injection in mcp-shell's 'secure mode' allows any MCP client to execute arbitrary shell commands by exploiting Git's runtime alias mechanism. The security validator in security.go blocks common shell metacharacters but omits '!', the prefix Git uses to invoke shell aliases via '-c alias.NAME=!CMD'. Because /usr/bin/git is in the default allowed_executables list and the CVSS PR:N vector confirms no authentication is required, all default Docker deployments (mcpuser, UID 1000, Git pre-installed) are exploitable by any entity with MCP connectivity. A fully functional PoC is published in the GHSA advisory; no CISA KEV listing is present at time of analysis.
Arbitrary code execution in QWED-MCP before 0.2.1 stems from its verify_math_expression() library function feeding attacker-controlled expression and claimed_result strings into SymPy's parse_expr() with an unrestricted built-in namespace, turning a math-verification routine into a Python eval() sink. Any downstream integration that forwards untrusted input to this public API lets an attacker run OS commands as the qwed-mcp process user (root-level RCE confirmed in a container by the vendor advisory). Publicly available exploit code exists via the GHSA advisory PoC, but this is not listed in CISA KEV; the published CVSS is 9.8 while real reach depends on how the library is wired up.
PraisonAI's async Jobs API FastAPI service exposes all seven `/api/v1/runs` endpoints - submit, list, status, result, cancel, delete, and stream - with zero authentication on every route, allowing any network-reachable caller to execute arbitrary prompts against the operator's configured LLM credentials and enumerate or exfiltrate cross-tenant job outputs. Publicly available exploit code is documented in GHSA-2jgc-f764-c5r2, with all five attack primitives confirmed via proof-of-concept returning HTTP 202/200/204 with no credentials. This is a distinct, unpatched sibling of CVE-2026-44338 - the Flask server fix at 4.6.34 did not touch the FastAPI jobs module, which remained fully unauthenticated through version 4.6.51.
Server-Side Request Forgery in PraisonAI's Jobs API (pip/praisonai < 4.6.58) results from two compounding flaws: a fail-open DNS error handler in `JobSubmitRequest.validate_webhook_url()` that silently accepts any webhook URL when `socket.gaierror` is raised, and a TOCTOU race where `JobExecutor._send_webhook()` performs a completely independent DNS resolution via `httpx.AsyncClient` minutes to hours after validation. Authenticated attackers with a valid API bearer token can submit a job whose `webhook_url` hostname returns NXDOMAIN at validation time, then update DNS to a private IP before job completion, causing the executor to POST job result data to internal infrastructure. A detailed proof-of-concept is publicly available in GHSA-rg5q-pp8p-f7jm; no public exploit identified at time of analysis beyond the PoC, and this CVE is not listed in CISA KEV.
Authentication bypass in PraisonAI's HTTP agent-serving layer allows unauthenticated remote invocation of registered agents despite the operator having configured an API key via --api-key. The root defect is in _create_agents_app(): it never reads config["api_key"] and never attaches a FastAPI Depends() auth dependency to POST /agents and POST /agents/{agent_name}, making the advertised --api-key flag a no-op. A public proof-of-concept confirms HTTP 200 responses to credentialless requests on all agent invocation routes while sibling /api/v1/ routes correctly return 401; no CISA KEV listing was identified at time of analysis.
Workspace boundary escape in PraisonAI's praisonai.code CODE_TOOLS exposes three independent path traversal vectors affecting all file operation and command execution tools exported for use by AI agents. Agents configured with a workspace parameter - intended as a filesystem security boundary - can be manipulated via prompt injection or untrusted input to read, write, enumerate, and execute commands outside that boundary, bounded only by the process user's OS permissions. Publicly available proof-of-concept code demonstrates all six bypass paths against real praisonai.code agent tools; no CISA KEV listing exists at time of analysis.
Server-Side Request Forgery in praisonaiagents (pip package, versions < 1.6.58) allows any attacker who can influence an AI agent's crawl target - via crafted task instructions or prompt injection embedded in previously crawled content - to exfiltrate cloud instance metadata (including IAM credentials), internal localhost services, and RFC1918 API endpoints. The web_crawl tool's SSRF protection validates only the initial URL's hostname IP, then invokes httpx with follow_redirects=True, allowing an attacker-controlled public URL to 302-redirect the agent to 169.254.169.254 or 127.0.0.1 without any re-validation. This is an incomplete fix for a prior SSRF class in the same component. A fully functional proof-of-concept is publicly documented in GHSA-5r34-2g38-6569, and no public exploit identified at time of analysis beyond the PoC; no CISA KEV listing is present.
Arbitrary code execution in NLTK (Natural Language Toolkit) through 3.9.4 allows attackers to run Python code when a victim application loads a malicious transition-parser model file. The TransitionParser.parse() method deserializes model data via pickle with restricted=False, so an attacker-supplied model embedding pickle gadget chains executes with the privileges of the loading process. No CISA KEV listing or public exploit code is identified at time of analysis, though this class of pickle-RCE bug is trivially weaponizable once a malicious model is delivered.
Denial-of-service in Mistune Python Markdown parser versions 3.3.0-3.3.2 allows remote unauthenticated attackers to crash any process that renders user-supplied Markdown by submitting input with hundreds of consecutive asterisk characters. The recursive HTMLRenderer.render_token() traversal grows proportionally to emphasis nesting depth and exceeds Python's default recursion limit, raising an unhandled RecursionError that terminates the parsing process. No public exploit identified at time of analysis, though the fix commit itself demonstrates the attack pattern explicitly in its regression test suite.
Insecure file creation in RansomLook (≤ 2.0.0) exposes the Flask session-signing secret to any local OS user with read access to the application home directory, enabling complete authentication bypass. The secret key governs Flask session cookie signing and the legacy API-key derivation function; possession of it allows an attacker to forge valid session cookies and impersonate any user, including administrators. In LDAP-configured deployments, exploitation is especially direct because the session user loader accepts arbitrary usernames without verifying their existence against any user store. No public exploit has been identified at time of analysis.
Unsafe pickle deserialization in Flair 0.15.0 and 0.15.1 allows arbitrary code execution with the privileges of the loading process when a victim calls ClusteringModel.load() on an attacker-supplied model file. The critical compounding factor is a false remediation: CVE-2024-10073 designated 0.15.0 as the fixed version after clustering was dropped from the documented API, but flair/models/clustering.py remains physically present in the PyPI-distributed wheels for both 0.15.0 and 0.15.1 and is directly importable, voiding the prior CVE's resolution. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Remote code execution in Xinference (all versions before 2.12.0) allows any user with model-launch access to execute arbitrary Python code on the server at worker-process privilege level. Six model loader call sites across the rerank, embedding, and LLM subsystems hardcode trust_remote_code=True when invoking Hugging Face AutoTokenizer.from_pretrained, meaning a registered model with an attacker-controlled path can ship a malicious tokenizer_config.json whose auto_map entries are imported and executed unconditionally upon model load. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but any Xinference deployment that permits user-defined model registration is exposed without the 2.12.0 patch.
Unbounded recursion in NLTK's JSONTaggedDecoder.decode_obj() (nltk/jsontags.py) allows unauthenticated remote attackers to crash the Python process by submitting a deeply nested JSON payload exceeding Python's default recursion limit of 1000. All NLTK releases before 3.9.4 are affected; exploitation depends on whether the calling application exposes JSONTaggedDecoder to externally-supplied JSON input. A public proof-of-concept is included in the GHSA advisory; no confirmed active exploitation (CISA KEV) has been identified at time of analysis.
Remote code execution in Xorbits Inference (Xinference) 2.5.0 and earlier lets a remote attacker run arbitrary OS commands in the server process by abusing an unsafe eval() in the Llama3 tool-call parser. Any request to the OpenAI-compatible /v1/chat/completions endpoint with a tools field triggers evaluation of model-generated Python, so an attacker who steers the model's output via a crafted prompt achieves full server compromise; because authentication is disabled in the default deployment, the vendor advisory rates this exploitable by an unauthenticated remote attacker. This is fixed in 2.7.0; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Arbitrary code execution in Facebook Research Hydra prior to version 1.3.4 allows any party who can supply untrusted configuration - including YAML config files, CLI overrides, or ML model metadata - to invoke dangerous Python callables through hydra.utils.instantiate(). The vulnerability stems from _resolve_target() accepting any Python callable path without restriction, enabling an attacker to trigger functions such as os.system, subprocess.Popen, or builtins.exec inside the consuming application's process. No public exploit code has been identified at time of analysis, and no CISA KEV listing exists; the upstream fix is confirmed shipped in v1.3.4.
Remote code execution in Omnigent's multi-tenant runner allows any authenticated user to hijack the runner process by uploading a crafted agent bundle that specifies a dotted Python import path (e.g., subprocess.check_output) as a server-side callable tool. The server's bundle validator failed to inspect the callable field, so the runner blindly imported and executed the specified Python symbol with its own process permissions. All Omnigent deployments prior to version 0.3.0 running in shared or multi-tenant mode are affected; no public exploit has been identified at time of analysis, though the GHSA advisory and fix PR provide a detailed exploitation roadmap.
Uncontrolled recursion in django CMS prior to 5.0.8 allows an authenticated staff user to corrupt the plugin tree and deny service by exploiting a missing cycle guard in the move_plugin endpoint. By supplying the plugin's own primary key or a descendant's ID as the plugin_parent value in a crafted POST request, the attacker creates a parent-child cycle that causes the _get_descendants_cte and _get_ancestors_cte recursive CTE queries to loop indefinitely, exhausting database recursion limits and consuming web request workers. The same 5.0.8 release also patches a related information disclosure path where clipboard copy operations lacked source-side permission checks, allowing a staff user to exfiltrate plugin content from placeholders they have no access to - consistent with the 'Information Disclosure' tag on this advisory. No public exploit identified at time of analysis.
Remote denial-of-service in vouch-proxy v0.47.2 and earlier crashes the server process with a single unauthenticated HTTP request. The /validate endpoint's multipart cookie reassembly routine in pkg/cookie/cookie.go parses the total part count directly from the attacker-controlled Cookie header name - an N value of 10 billion passed as VouchCookie_1of10000000000 triggers a make([]string, N) call requesting approximately 160 GB of heap, immediately raising a Go runtime fatal out-of-memory error. No authentication, session token, or prior interaction is required; a fully working PoC with Docker reproduction artifacts is publicly disclosed in the GitHub Security Advisory, though no CISA KEV listing is confirmed at time of analysis.
Arbitrary code execution in aeon 1.3.0 is triggered when a user loads a maliciously crafted CSV dataset file via the `load_time_series_segmentation_benchmark` or `load_human_activity_segmentation_datasets` functions, both of which passed CSV column values directly to Python's `eval()` built-in without validation. An attacker who convinces a data scientist or researcher to open a crafted dataset file can execute arbitrary Python code with the privileges of the running process. No public exploit has been identified at time of analysis, but the upstream fix commit is public and the vulnerability class is trivially replicable given the use of bare `eval()`.
Remote code execution in aeon 1.3.0 is possible when a user loads a maliciously crafted CSV dataset via the `load_human_activity_segmentation_datasets` or `load_time_series_segmentation_benchmark` functions, which pass unvalidated column values directly to Python's `eval()`. An attacker who can deliver a malicious file or dataset URL to a target data scientist can execute arbitrary Python code in the victim's process with their full privileges. No public exploit has been identified at time of analysis, though ZDI (ZDI-CAN-29160) holds technical details; the upstream fix replacing `eval()` with `ast.literal_eval()` is available as a commit but a tagged patched release has not been independently confirmed.
Arbitrary file read, write, and Python code execution in Agno's PythonTools (agno.tools.python) exposes any file accessible to the agent process via path traversal sequences injected into the file_name argument of read_file, save_to_file, or run_python_file. The root cause is use of Path.joinpath() without resolving or validating the resulting path against the intended base_dir boundary, enabling escape via sequences such as '../../../../../../etc/passwd'. No public exploit has been identified at time of analysis, but the attack is trivially constructible and can be delivered through direct tool invocation or prompt injection embedded in agent-processed content, giving any untrusted input source a path to OS-level code execution within the agent process.
Remote code execution on the Wazuh cluster master node is achievable by any attacker who controls a cluster worker node, exploiting unsafe Python builtin resolution in the distributed API merge path. Affected versions span 4.0.0 through 4.14.5 and 5.0.0-beta1; the vulnerable code in framework/wazuh/core/results.py called getattr(builtins, type_) with attacker-supplied strings from worker JSON responses, enabling exec or eval injection. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the attack primitive is mechanically trivial once a worker node is controlled, with the payload executing as root on the master.
Authenticated remote code execution affects Talebook (MyBooks/PoxenStudio) ebook management server versions 3.41.2 and earlier, where an administrator can inject arbitrary Python into the auto-generated auto.py settings module via a crafted SOCIAL_AUTH key name. Because the server imports auto.py as a live module and can auto-restart to reload it, injected statements execute with the service account's privileges, enabling data disclosure, file modification, persistence, or service disruption. No public exploit is identified at time of analysis; the fix is version 3.42.0, and chained authorization/registration weaknesses noted by the vendor could lower the effective privilege barrier.
Cross-dataset authorization bypass in GeoLens prior to 1.2.3 allows unauthenticated network callers and low-privileged authenticated users to read private dataset content - including vector tile geometries, raster pixels, backing-table rows, column schemas, and sampled values - that they have no access to. The root flaw is a consistent pattern across six distinct endpoints: the API authorizes the resource named in the URL but fails to re-authorize a second, caller-influenced dataset reached through a relationship, layer reference, VRT mosaic, or request body. No public exploit has been identified at time of analysis, but the most severe findings require zero authentication, making them trivially exploitable by any network-reachable caller.
Server-side request forgery in the Red Hat Ansible Automation Platform 2 Controller's HashiCorp Vault credential plugin lets an authenticated user with credential-creation rights force the controller pod to leak its own Kubernetes service account token. When a HashiCorp Vault Secret Lookup credential configured for kubernetes_role authentication is tested, the kubernetes_auth() routine in awx_plugins/credentials/hashivault.py transmits the pod token to an attacker-supplied URL. With that token the attacker gains Kubernetes API access to control-plane namespaces, enabling full pod CRUD and secret reads including database credentials and the Django SECRET_KEY. No public exploit identified at time of analysis, and the flaw is not on the CISA KEV list.
Remote code execution in CodeWhale (packages codewhale and codewhale-tui) versions 0.8.41 through 0.8.63 allows an attacker to execute arbitrary Python code on the victim's machine by exploiting a hardcoded approval bypass in the rlm_eval built-in tool. The tool's approval_requirement() method returned ApprovalRequirement::Auto, causing the engine to silently skip user approval prompts regardless of the operator's configured --approval-policy, enabling prompt injection attacks through any external content the agent reads. No public exploit has been identified at time of analysis, but the attack surface encompasses any CodeWhale agent workflow that fetches untrusted content such as web pages, repository files, or MCP tool results.
Arbitrary Python code execution in FreeCAD's BIM module (versions 0.19 through pre-1.1.1) is triggered when a user opens a malicious project template file through the BIM Project Manager's Load Template function. The loadTemplate() method in BimProjectManager.py passes FCStd metadata fields (wpposition, wpu, wpv, wpaxis) directly to Python's built-in eval(), enabling an attacker who can deliver a crafted template to achieve full code execution under the victim's user account. No public exploit has been identified at time of analysis; the vendor-released patch is confirmed in version 1.1.1.
Arbitrary Python code execution in FreeCAD's BIM Workbench (versions 0.19 through 1.1.0) is triggered when a user creates a TechDraw page from a malicious SVG template, due to an unsafe eval() call in BimTDPage.py at line 87. Exploitation requires social engineering - an attacker must deliver a crafted SVG template to a victim who then performs the TechDraw page creation action. No public exploit has been identified at time of analysis and no CISA KEV listing exists, but the vulnerability is structurally trivial (direct eval of attacker-controlled input, CWE-95) and the fix is available in version 1.1.1.
Remote code execution via crafted .FCStd document in FreeCAD prior to 1.1.2 allows arbitrary Python execution when a victim opens a malicious file. The deserialization path in PropertyPythonObject::Restore() passes attacker-controlled module names directly to PyImport_ImportModule(), executing module-level Python code on import; the legacy pickle branch additionally invokes an attacker-controlled class constructor via PyObject_CallObject(). No public exploit or CISA KEV listing is identified at time of analysis, but exploit construction is straightforward for any researcher who can craft the FCStd XML schema.
Quadratic CPU consumption in sqlparse versions prior to 0.6.0 allows unauthenticated remote denial-of-service via crafted deeply-nested SQL payloads submitted to any application calling sqlparse.parse(), sqlparse.format(), or sqlparse.split(). A ~2KB malicious input with 500-2000 nesting levels can consume approximately 10 seconds of CPU per request - a ~5000x amplification ratio - before depth or token limits raise a SQLParseError. No active exploitation is confirmed in CISA KEV, though the GHSA advisory includes a detailed proof-of-concept demonstrating the attack; CVSS 4.0 rates availability impact as High (8.7) with no authentication required.
CPU exhaustion via ReDoS in sqlparse affects all Python applications that pass caller-controlled SQL text to sqlparse.parse(), sqlparse.format(), or sqlparse.split() prior to version 0.6.0. The root cause is a backreference regex pattern in the dollar-quoted literal lexer that, combined with the per-position lexer loop, produces O(n²) CPU complexity when processing inputs containing many unique, unclosed dollar-quote openers or multiline comment delimiters — making it trivially exploitable from the network with no authentication. No public exploit code or CISA KEV listing has been identified at time of analysis, but the fix commit includes a purpose-built benchmark script that doubles as a functional reproduction guide.
OS command injection in @argos-ci/core <=6.2.0 allows any attacker who can influence a CI pipeline's branch or ref name to execute arbitrary shell commands on the CI runner with the same privileges as the Argos upload process. The vulnerable sink is in packages/core/src/ci-environment/git.ts:89, where execSync() receives an unsanitized branch string interpolated into a template literal passed directly to /bin/sh -c, which evaluates $() command substitution and other metacharacters before spawning git. A fully working proof-of-concept exploit exists (GHSA-4x45-gxvp-6283) and the attack surface is widened by the fact that hasRemoteContentAccess: false - the configuration that triggers the vulnerable code path - is the default for projects without a connected Git provider integration.
Arbitrary Python code execution in IBM Langflow OSS 1.0.0-1.11.5 is possible for any authenticated low-privileged user by embedding malicious code in custom components within stored flows. The root cause is a missing server-side authorization check (CWE-862) - the platform executes custom Python component logic without verifying whether the caller has sufficient privileges to run arbitrary code, not a failure to authenticate them. IBM has released a patch via support advisory 7286666; no public exploit or CISA KEV listing has been identified at time of analysis.
Path traversal in @openhop/server (npm, versions ≤0.3.5) allows unauthenticated remote attackers to read or permanently delete arbitrary `.yaml` files accessible to the OpenHop process outside its configured flow data directory. The root cause is that `FlowStore.filePath()` passes caller-supplied HTTP route parameters directly to Node.js `path.join()` without any sanitization or allowlist validation, and Fastify's underlying `find-my-way` router URL-decodes the parameter before it reaches application code, enabling `..%2F`-encoded directory traversal. A fully functional PoC is publicly available with Docker-based reproduction steps; no KEV listing at time of analysis. Docker deployments expose the server on all interfaces by default, enabling direct network exploitation without user interaction.
Unauthenticated LAN access to the ESPHome Device Builder dashboard on Home Assistant add-on deployments allows any device on the local network to gain host-equivalent control with no credentials. The ingress site, which deliberately skips authentication because the HA supervisor is supposed to authenticate upstream, was bound to 0.0.0.0 instead of loopback and the supervisor gateway. Because the add-on uses host networking for mDNS, this exposed the no-auth site on the host's LAN interface, directly bypassing the supervisor's authentication layer. An attacker with LAN access can run arbitrary Python via external_components at compile time, execute arbitrary shell through compile/validation subprocesses, and read or write arbitrary files in the config and data directories. No public exploit has been identified at time of analysis.
Remote code execution in functype-mcp-server 1.4.3 and earlier allows any MCP client - including an LLM agent manipulated via prompt injection - to execute arbitrary JavaScript in the server process by invoking the `set_functype_version` tool with a `file:`, `git+`, or URL package-alias as the version string. The server interpolates the unsanitized input directly into a `pnpm add` specifier, installs the attacker-controlled package as the `functype` alias, then immediately dynamic-imports `functype/cli` from the poisoned location, running module-level attacker code with full MCP server process privileges. A fully automated Docker-based proof-of-concept confirming end-to-end RCE is documented in GHSA-wcjj-9m6g-2fr2; no public exploitation has been confirmed (not in CISA KEV), and a patched version 1.4.4 is available.
nuxt-ollama versions 1.2.26 through 1.3.0 unconditionally places the Ollama cloud API key into Nuxt's public runtime config, causing it to appear verbatim in every server-rendered HTML page inside the `window.__NUXT__` script block, readable by any unauthenticated HTTP client. Any visitor or web crawler that fetches any page of an affected application can extract the `api_key` from the serialized SSR payload with a single GET request, then impersonate the operator against the Ollama cloud API to incur billing charges, exhaust rate limits, or exfiltrate stored model data. A publicly available PoC using Docker and Python has dynamically confirmed the leak; no public exploit identified at time of analysis for active KEV-level exploitation.
Server-side request forgery in Open WebUI prior to 0.11.1 allows authenticated users to reach internal cloud infrastructure by exploiting gaps in Python's `is_global` address classification. The web retrieval endpoints POST /api/v1/retrieval/process/web and /process/web/search relied solely on Python's built-in global-address check, which does not reject the Azure platform channel IP (168.63.129.16) or other reserved ranges such as multicast, 6to4 relay, NAT64, IPv6 site-local, and embedded-IPv4 representations. On Azure-hosted deployments this enables exfiltration of platform metadata, certificates, and management tokens accessible via the wire-link channel. No public exploit identified at time of analysis; vendor-released patch exists as version 0.11.1.
DNS rebinding SSRF in Open WebUI versions 0.9.6 through 0.11.0 allows authenticated users who control authoritative DNS to bypass hostname validation in SafePlaywrightURLLoader and reach internal services or cloud metadata endpoints. The flaw exists because Python validates the resolved hostname at check time, then the Playwright browser independently re-resolves the same hostname at use time - enabling an attacker to serve a public IP during validation and a private or link-local IP for the actual fetch. The issue is fixed in v0.11.1 by routing all fetches through the SSRF-safe requests session, eliminating the second resolution. No public exploit code or CISA KEV listing is present.
Remote code execution via unsafe Python pickle deserialization in the community.general Ansible collection's memcached fact cache plugin gives unauthenticated network-adjacent attackers full control of the Ansible controller. Despite documenting JSON as its storage format, the plugin delegates serialization entirely to python-memcached, which transparently pickles Python objects on write and unpickles them on read - a format that executes arbitrary Python code during deserialization. Because memcached has no native authentication and Ansible fact cache keys are derived from predictable hostnames, any attacker who can write to the target memcached instance can inject a malicious payload that executes when the controller next reads cached facts. No public exploit or CISA KEV entry has been identified at time of analysis.
Remote code execution in Google Cloud Agent Development Kit (ADK) for Python versions 2.0.0 through 2.6.0 allows an unauthenticated remote attacker to run arbitrary code on the host by submitting a crafted test session replay to the 'adk web' developer interface when the pytest package is present. The flaw stems from an incomplete input-restriction check (CWE-184) that lets malicious replay content reach code execution. No public exploit has been identified at time of analysis, but the vendor rates it CVSS 10.0 and shipped a fix in v2.7.0.
Double-free memory corruption in libxml2's SAX parser Python bindings allows a remote attacker to crash Python applications by supplying XML documents with DTD-defined enumerated attribute values, triggering a use-after-free in the attributeDecl callback. The vulnerability (CWE-763) is confirmed by Red Hat and affects all major RHEL versions (6 through 10) as well as Red Hat OpenShift Container Platform 4 and Hardened Images. While the confirmed impact is a reproducible denial of service, the Red Hat-provided CVSS vector (C:H/I:H/A:H with scope change) signals that Red Hat assesses the double-free as carrying latent code-execution potential beyond the confirmed crash. No public exploit and no KEV listing exist at time of analysis.
Remote code execution in Axolotl through 0.18.0 allows an attacker who controls a Hugging Face model repository to execute arbitrary Python code on any machine running an Axolotl training job with multipack patches enabled. The root cause is a logic flaw in `_apply_multipack_patches()`: when a user has not explicitly set `trust_remote_code` in their YAML config (leaving it as Python `None`), the guard condition `self.cfg.trust_remote_code is not None` evaluates to `False`, skipping the override assignment and leaving `has_remote_code=True` from the model's own metadata claim. Downstream code in `multipack.py` then calls `AutoModelForCausalLM.from_pretrained` with `trust_remote_code=True` hardcoded, executing whatever Python the model repository supplies. No public exploit is identified at time of analysis, but the attack surface is broad for teams running automated fine-tuning pipelines that source models from HuggingFace without explicit config hardening.
Remote code execution in LaVague 0.2.35, an LLM-driven web-automation agent framework, arises because PythonFromMarkdownExtractor.extract_as_object evaluates language-model output that is derived from attacker-influenced web page content. An attacker who controls or poisons a page the agent visits can use indirect prompt injection to coerce the model into emitting Python that is then eval'd and executed on the operator's host with no human review. Reported by VulnCheck (CWE-94); no public exploit identified at time of analysis and it is not listed in CISA KEV.
Path traversal in Google Cloud Agent Development Kit (ADK) Python versions 1.9.0 through 1.21.0 exposes arbitrary server files to unauthenticated remote attackers via a crafted `file_path` query parameter on the builder endpoint. The root cause, confirmed by the upstream commit diff, is that `fast_api.py` passed the user-supplied path directly into filesystem operations without sanitization or boundary enforcement, allowing `../` sequences to escape the agents directory. No public exploit code or active exploitation has been identified; vendor-released fix is available in v1.22.0.
Improper OCSP response validation across the Snowflake Python, Go, JDBC, and Node.js drivers allowed a revoked TLS certificate to be treated as valid, enabling a man-in-the-middle attacker to intercept and tamper with driver-to-Snowflake TLS sessions. The root flaw is twofold: OCSP stapled or fetched responses were not reliably bound to the specific certificate under validation, and definitive OCSP verification failures were treated as transient errors (soft-fail), causing the driver to proceed with a connection rather than abort it. Exploitation requires a network-adjacent or on-path position combined with possession of a revoked certificate and its corresponding private key for a Snowflake or storage-stage hostname; no public exploit is identified at time of analysis and EPSS data was not provided, but the CVSS AC:H reflects these steep prerequisites.
Token forgery in python-jose through 3.5.0 lets an attacker who possesses the service's asymmetric public key mint valid HS256 (HMAC) JWTs, because the library's HMAC key initialization accepts DER-encoded public keys that lack PEM armor or SSH prefixes and never rejects them as asymmetric material. This is a classic JWT algorithm-confusion (RSA/EC-to-HMAC) attack that succeeds whenever the verifying application does not explicitly restrict the accepted algorithms, and it represents an incomplete fix for CVE-2024-33663. There is no public exploit identified at time of analysis, though the technique is well-documented and the same class of flaw has prior public tooling.
Server-side request forgery in OpenStack Glance 16.0.0 through 32.0.0 allows authenticated tenant users to make the image service fetch arbitrary internal URLs, including cloud metadata endpoints at 169.254.169.254, turning the image import pipeline into a full-read SSRF channel. Three related flaws (CVE-2026-71196, CVE-2026-71197, CVE-2026-71198) stem from insecure default host filtering in the web-download import method, a DNS rebinding bypass that evades the validator, and absent host filtering in the HTTP image location API respectively. Because Glance stores fetched bytes as downloadable image data, none of these are blind SSRF - the full response body is directly retrievable by the attacker. No public exploit has been identified, but the cloud-credential-theft impact warrants urgent remediation in any multi-tenant or internet-facing OpenStack deployment.
DNS rebinding bypass in OpenStack Glance's web-download URI validator allows authenticated tenant users to circumvent host-filter restrictions and force the image service to fetch arbitrary internal URLs, enabling full-read SSRF exfiltration via the image download API. The validator evaluates host filters against the raw pre-resolution hostname, creating a TOCTOU window: an attacker's domain passes the check resolving to a legitimate external IP, then DNS rebinding redirects the actual fetch to internal targets such as the cloud instance metadata service at 169.254.169.254. Glance versions 16.0.0 through 30.2.0, 31.0.0 through 31.1.0, and 32.0.0 are affected; no public exploit has been identified at time of analysis.
Full-read server-side request forgery in OpenStack Glance's HTTP image location API allows authenticated tenant users to exfiltrate arbitrary internal network resources, including cloud metadata endpoints, when the HTTP store backend is enabled. Unlike a typical blind SSRF, Glance stores the fetched content as image payload that the attacker can then download in full, making credential theft from the instance metadata service (169.254.169.254) directly achievable. CVE-2026-71198 is one of three coordinated SSRF issues (OSSA-2026-038) reported independently by Sergey Kanibor, Sami Yessou, and Abhishek Kekane; this specific variant was credited to Kekane of Red Hat.
Unauthenticated cross-origin RCE in Windows ML CLI (winml-cli < 0.4.0) is reachable when a developer runs the `serve` command, which exposes a localhost HTTP API with a wildcard CORS policy and no authentication gate. Any malicious webpage visited by the user while the server is running can send cross-origin requests to `/v1/cli/build` or `/v1/cli/config`, inject `trust_remote_code=true`, and cause the server to call `AutoConfig.from_pretrained(trust_remote_code=True)` - downloading and executing attacker-controlled Python code from a remote model repository as the server user. The vendor has released a fix in version 0.4.0; no public exploit is identified at time of analysis.
Memory exhaustion via unbounded decompression in HTTPX2 (all versions before 2.12.0) allows any HTTP server the client contacts to cause severe memory pressure or out-of-memory process termination by returning a crafted compressed response body. The content decoders in `_decoders.py` call `decompress()` without a size cap, so a single 64 KiB compressed chunk can inflate to approximately 64 MiB in one allocation across gzip, deflate, brotli, and zstd encodings - all enabled by default. No active exploitation is confirmed in CISA KEV, and no public proof-of-concept is referenced, but the decompression-bomb technique is well understood and trivially reproducible.
HTTPX2's SOCKS5 proxy implementation omits TLS negotiation for WebSocket Secure (wss://) origins, exposing the full WebSocket session - opening handshake, query parameters, Authorization headers, cookies, and message frames - in plaintext to anyone who can observe or control the proxy path. Affected are applications using Client.websocket() or AsyncClient.websocket() in HTTPX2 versions 2.6.0 through 2.9.1 when routing through a SOCKS5 proxy. An adjacent-network attacker can passively eavesdrop on or actively modify traffic, and can impersonate the WebSocket server due to the missing certificate verification step. No public exploit code has been identified at time of analysis and this CVE does not appear in the CISA KEV catalog.
Python bytecode scanning gap in agentverus-scanner allows supply-chain attackers to smuggle malicious __pycache__ .pyc files past the tool's static and semantic analysis engines, which only inspect source .py files in companion code directories. Packages carrying malicious bytecode alongside benign source receive a CERTIFIED verdict with elevated trust scores, causing downstream environments that trust the scanner to silently execute attacker-controlled code on import. No public exploit code has been identified at time of analysis, but the VulnCheck advisory and GitHub issue #27 document the bypass technique in sufficient detail for reproduction.
Incomplete file coverage in claude-skill-antivirus v2.1.3 allows malicious Claude skill packages to bypass security scanning entirely when installed from local directories. The scanner reads only the SKILL.md manifest file, leaving Python source (.py), bytecode (.pyc), and all other executable artifacts in the scripts/ subdirectory completely unanalyzed. Skill authors can embed arbitrary malicious payloads in non-manifest files and receive a SAFE verdict with a perfect 100/100 trust score, providing users with false assurance before installation.
Tencent AI-Infra-Guard's skill-scan component allows scanner bypass via hardcoded exclusion of Python compiled bytecode, enabling malicious skill packages to pass a false SAFE verdict and execute arbitrary code on operator hosts. Attackers supply a skill with benign `.py` source decoys alongside malicious `.pyc/.pyo/.pyd` bytecode in `__pycache__` directories; because three separate scanning surfaces in versions through v4.6.0 unconditionally skip these artifacts, the auditing LLM never sees the malicious payload. CPython's PEP 552 UNCHECKED_HASH behavior executes `.pyc` at import time regardless of source presence, triggering code execution when an operator installs the skill. No public exploit identified at time of analysis, but the upstream fix commit and GitHub Issue #531 confirm the flaw.
Scrapy's S3DownloadHandler transmitted s3:// requests - including signed AWS Authorization headers, temporary session tokens, and full S3 object contents - over plaintext HTTP by default in all versions prior to 2.17.0, exposing credentials and data to any network attacker with a man-in-the-middle position. A passive observer on the network path can harvest AWS credentials silently; an active attacker can modify S3 response bodies, status codes, and headers to poison scraped data exports, corrupt HTTP caches, or manipulate subsequent crawl targets through forged redirects. The root cause is a logic inversion in a single line of s3.py: HTTPS was opt-in rather than opt-out. No public exploit has been identified at time of analysis, and a patched release (2.17.0) is confirmed available.
Cleartext HMAC key exposure in Amazon SageMaker Python SDK's @step and @remote decorator components (versions before v2.256.0 and v3.11.0) lets any authenticated IAM principal within the same AWS account read the signing key from DescribePipeline API responses, then forge valid integrity signatures to inject attacker-controlled code into a victim user's pipeline execution context. No public exploit has been identified and the vulnerability is absent from the CISA KEV catalog, but the attack chain is mechanically straightforward for any account member holding the sagemaker:DescribePipeline permission. Vendor-released patches for both SDK branches are confirmed via GitHub release tags v2.256.0 and v3.11.0 and AWS Security Bulletin 2026-093-aws.
Unsafe PyYAML deserialization in ModelScope through v1.40.0 enables remote code execution when users load model configuration files from attacker-controlled repositories. The vulnerability exists in at least two documented components - the audio TTS voice module (voice.py) and the multimodal mPLUG configuration loader (configuration_mplug.py) - which use PyYAML's unsafe yaml.Loader that processes Python object construction tags such as !!python/object: during deserialization. An attacker who publishes a poisoned model repository can achieve full code execution on any victim system that loads the model, with no public exploit identified at time of analysis.
Write-before-consent in Hugging Face Transformers' GenerativePreTrainedModel.load_custom_generate() allows attacker-controlled Python files to be silently written to ~/.cache/huggingface/modules/ even when the user declines the trust prompt. Affected versions span 4.49.0 through 5.8.1. While immediate execution is blocked by the trust gate, the persisted cache file creates a stale-cache collision risk: subsequent loads of unrelated trusted models may inadvertently execute the previously cached, attacker-supplied Python code. No public exploit has been identified at time of analysis.
Remote code execution in lllyasviel Fooocus 2.1.854 through 2.5.5 allows any user who can upload an image to execute arbitrary Python code on the hosting server. The vulnerability stems from the `get_list` function in `modules/meta_parser.py` passing a `styles` field extracted from image EXIF metadata directly to Python's `eval()` without sanitization or sandboxing. A detailed technical writeup exists at mrbruh.com/fooocus and the vulnerable code path is publicly visible in the repository; no confirmed active exploitation has been identified at time of analysis, and EPSS stands at 0.24% (15th percentile).
Denial-of-service in Tornado prior to 6.5.8 allows unauthenticated remote attackers to stall the entire server by sending a single POST request with millions of separator-delimited fields in an application/x-www-form-urlencoded body. Because Tornado's RequestHandler parses the body synchronously before handler dispatch using urllib.parse.parse_qs without a max_num_fields limit, a request body up to the 100 MB default max_buffer_size can consume all CPU on the single-threaded event loop and delay every concurrent connection. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity (AV:N/AC:L/PR:N/UI:N) makes this trivially automatable against any exposed Tornado endpoint.
Out-of-bounds read in Exiv2's CrwMap::decodeBasic() function affects versions prior to 0.28.9, impacting applications that use the library to parse Canon CRW image metadata. Classified as low severity by the Exiv2 maintainers, this flaw has only been reproduced using a dedicated fuzz target - the standard exiv2 command-line tool cannot trigger it under normal operation. No public exploit exists and no active exploitation has been identified, making real-world impact minimal despite the memory safety class of defect.
Out-of-bounds write in Exiv2's RemoteIo::Impl::populateBlocks() affects all versions prior to 0.28.9, exploitable only when Exiv2 is invoked with a remote URL as input rather than a local file path. Memory corruption from the write could theoretically enable code execution in the Exiv2 process context if a user or automated pipeline fetches a specially crafted image from an attacker-controlled server. Fixed in the 0.28.9 release; no public exploit or KEV listing identified at time of analysis.
Authentication denial of service in free5GC AUSF v1.4.4 and current main allows an attacker with access to the AUSF SBI/N12 interface to permanently block a target subscriber from completing 5G authentication by flooding the AUSF with concurrent POST /nausf-auth/v1/ue-authentications requests for the same SUPI. Each concurrent request silently overwrites the active EAP-AKA' session context stored under that SUPI key, so the legitimate UE's EAP response is validated against mismatched cryptographic material (K_aut, XRES) and fails AT_MAC verification. No vendor patch has been released; a working proof-of-concept was reproduced in a controlled lab and is documented in the upstream GHSA advisory, with no CISA KEV listing identified at time of analysis.
Exponential backtracking ReDoS in Protego (pip/protego <= 0.6.1) allows any party who can serve a crafted robots.txt to freeze the `can_fetch()` call indefinitely, denying service to any application using this library for robots.txt compliance. A working proof-of-concept is publicly available in the GitHub security advisory GHSA-wjmf-p669-5m5p; the CVSS 4.0 score of 7.1 (VA:H) reflects meaningful availability risk for web-crawling deployments. No public exploit identified at time of analysis beyond the published PoC, and no CISA KEV listing exists.
Privilege escalation in piccolo_admin 1.13.0 and earlier allows any non-superuser admin to permanently elevate to superuser by exploiting a two-flaw chain: the `superuser_validators` access-control function uses a deny-list that omits GET, and the `SessionsBase.token` column is stored as plaintext Varchar without `secret=True`, causing it to appear in every GET /api/tables/sessions/ response. An authenticated low-privilege admin can harvest the superuser's live session token in a single unauthenticated-to-superuser GET request, replay it to issue a PATCH that sets `superuser=true` on their own row, and permanently retain elevated access - the stolen cookie is then discarded. A publicly available proof-of-concept with full reproduction steps was included in the GitHub security advisory (GHSA-2gh4-jmwq-rr8w); no CISA KEV listing is present at time of analysis.
Blind SQL injection in WsgiDAV's MySQLBrowserProvider sample module (versions <= 4.3.4) allows unauthenticated network attackers to read arbitrary data from the backing MySQL database via URL path manipulation. The record key segment of the URL is concatenated directly into a WHERE clause without escaping, enabling a boolean status-code oracle that supports full character-by-character data extraction. A secondary typo in the numeric-type check (`INTT` instead of `INT`) ensures all primary key types take the vulnerable quoted branch, and a working PoC with complete extraction script has been publicly confirmed. No public exploit identified as confirmed actively exploited (CISA KEV), but the PoC lowers the exploitation bar significantly.
Cross-project Kanban data destruction in Vikunja allows any authenticated user to permanently wipe `task_buckets` and `task_positions` for any project view in the entire instance, regardless of project membership. Affecting versions 0.24.6 through 2.4.0, the `ProjectView.Delete` method performs two unscoped cascading SQL deletes using only the URL-supplied view ID after an authorization check that verifies admin rights on the attacker's own project - never confirming the target view belongs to that project. A working PoC is publicly available via the GHSA advisory; view IDs are auto-increment integers, making full-instance enumeration trivial with no prior reconnaissance.
Remote code execution in BISHENG's workflow engine (versions before 2.6.0) allows any authenticated user to submit crafted Code node definitions to the POST /api/v1/workflow/run_once endpoint, where they are evaluated via Python's exec() built-in without sandboxing or process isolation. Successful exploitation grants full server-side code execution with access to the host filesystem, stored credentials, and internal network resources reachable from the BISHENG backend process. No public exploit or CISA KEV listing has been identified at time of analysis, but the low-complexity, authenticated network attack path represents a critical risk especially in multi-tenant or shared-access deployments.
Arbitrary code execution in SpeechBrain before v1.1.1 is triggered during checkpoint candidate enumeration when PyYAML's unsafe loader parses attacker-controlled CKPT.yaml files in the configured checkpoint path. An attacker who can plant a crafted CKPT.yaml - for example via a malicious pretrained model distributed through a public model repository - can embed !!python/object/apply YAML tags that cause Python to instantiate arbitrary objects at parse time, achieving code execution before any checkpoint is ever selected for recovery. No public exploit specific to this CVE has been identified at time of analysis, and it is not listed in the CISA KEV catalog, but the underlying PyYAML unsafe deserialization class is extensively documented and exploit techniques are widely known.
Unauthenticated remote code execution affects mims-harvard ToolUniverse through 1.2.6, where the python_code_executor tool runs caller-supplied Python in a sandbox that can be escaped and the HTTP/MCP servers listen on all interfaces with no authentication. Any attacker who can reach the exposed port executes arbitrary code as the server process, since the deny-list source inspection can be bypassed via dunder attribute traversal and a per-call flag that widens the import allow-list. No public exploit code is identified at time of analysis, but the flaw is reported by VulnCheck and carries a CVSS 4.0 base score of 9.3; it is fixed in version 1.3.0.
Remote code execution in Flowintel's alerts settings update endpoint (versions >= 3.3.0) allows an authenticated high-privileged attacker to inject arbitrary Python statements into the application's live configuration module. The vulnerable endpoint in app/alerts/alerts.py interpolated attacker-supplied configuration keys directly into Python source written to conf/config_module.py, then triggered importlib.reload() - executing injected code in the server process. No public exploit has been identified and the vulnerability is not listed in CISA KEV, but successful exploitation yields full server-side code execution with the privileges of the Flowintel process.
Frappe's REST API before v15.115.0 contains an access control bypass (CWE-863) that allows any low-privileged authenticated user to read fields from Linked DocType records outside their permitted scope. When a document is fetched via the REST API, the framework resolves Link field references to other DocTypes but inconsistently re-applies the linked DocType's own permission rules, enabling horizontal data leakage across role boundaries. No confirmed active exploitation or public exploit code has been identified, but the low attack complexity and network-accessible vector create meaningful data exfiltration risk in multi-role or multi-tenant Frappe/ERPNext deployments.
Code injection in whichllm's run and snippet CLI commands allows a network-positioned attacker who controls a HuggingFace repository to achieve full arbitrary code execution on any victim's machine by publishing a repository containing a crafted GGUF filename with Python metacharacters. The script generation function in cli.py interpolates the HuggingFace Hub API siblings rfilename field directly into dynamically generated Python source without escaping, enabling a string-literal breakout that fires injected code before any model download occurs. No active exploitation is confirmed in CISA KEV and no public proof-of-concept is referenced; vendor-released patch v0.5.16 is available and directly remediates the root cause.
Unauthenticated remote code execution in SENAITE.CORE (senaite.core) 2.0.0 through 2.6.0 lets any network-reachable attacker run arbitrary Python in the Zope worker process by chaining a missing authorization check with an eval() sink in the JSON API. The anonymous-reachable /@@API/update route calls eval() on attacker-supplied RecordsField/RecordField values before any permission or write check fires, and a public working PoC (tested against the stock senaite/senaite:v2.6.0 Docker image) demonstrates credential-free command execution. Publicly available exploit code exists; the flaw is not listed in CISA KEV, so there is no confirmation of active exploitation.
Remote code execution in Google langfun before 0.1.2 arises because the default lf.query Python protocol evaluates model-generated Python expressions with no sandbox, letting remote unauthenticated attackers run arbitrary code in the host application by supplying crafted prompt inputs that steer the model into emitting executable code. Because langfun embeds directly in LLM-driven Python applications, any deployment that pipes untrusted prompt content through lf.query is exposed. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the CVSS 4.0 base score of 9.2 (CRITICAL) reflects full confidentiality, integrity, and availability impact.
ReDoS in NLTK's tgrep module exposes applications to indefinite CPU saturation when user-controlled tgrep patterns containing /regex/ nodes reach the _tgrep_node_action function, which compiles and executes them via Python's re.search without validation or timeout. All NLTK versions before 3.10.3 are affected when tgrep_positions() or tgrep_compile() accept external input. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; exploitation is conditional on a non-default, externally-exposed API configuration.
Catastrophic regex backtracking in NLTK before 3.10.0 allows unauthenticated remote attackers to saturate CPU and deny service to all users sharing the Python process by supplying crafted patterns to the Text.findall() or TokenSearcher.findall() methods. Any Python application that exposes NLTK regex search functionality to user-controlled input is affected across all platforms. No public exploit has been identified at time of analysis, but the vulnerability class (ReDoS) is well-understood and trivial to weaponize once the targeted endpoint is known.
Arbitrary file write and directory deletion in compliance-trestle's catalog-generate, profile-generate, and ssp-generate author commands exposes CI/CD pipelines to workspace-escape attacks when output arguments are derived from untrusted data. The affected commands construct output paths by joining a user-supplied argument onto the Trestle workspace root, but apply only a task-name-collision check rather than the PathSecurityValidator guard already used by the jinja command - allowing absolute paths or traversal sequences to escape the workspace entirely. With --force-overwrite, the primitive escalates to recursive deletion of an attacker-chosen directory tree followed by file creation, enabling indirect code execution by overwriting files (e.g., .github/workflows, .git/hooks, shell profile scripts) that a downstream pipeline subsequently executes. No public exploit is identified at time of analysis, though the GHSA advisory for the related jinja variant (GHSA-4q5v-7g7x-j79w) contains a detailed reproduction procedure.
Server-side template injection in Compliance-Trestle's custom Jinja2 include tags (`mdsection_include` and `md_clean_include`) allows a low-privileged local attacker to achieve arbitrary code execution when attacker-controlled OSCAL data containing Jinja2 syntax is processed during template rendering. All versions prior to 3.12.4 and the 4.0.0-4.0.3 line are affected; the fix is version 4.1.0. No CISA KEV listing or standalone public exploit has been identified at time of analysis, though security test payloads demonstrating the RCE gadget chain are present in the upstream fix commits.
Server-side template injection in compliance-trestle's custom Jinja2 tags enables remote code execution when the tool processes attacker-controlled Markdown or YAML content. Versions before 3.12.4 and the 4.0.x series through 4.0.3 are affected; the root flaw is that MDCleanInclude and MDSectionInclude re-parse included content using a non-sandboxed jinja2.Environment, allowing injected expressions to traverse Python object internals and invoke arbitrary OS commands as the Trestle process user. No public exploit or CISA KEV listing has been identified at time of analysis, but the attack surface is realistic in supply-chain workflows where users import third-party SSP or YAML documents.
Worker-thread exhaustion in Mesop's debug-mode hot-reload endpoint (prior to version 1.3.3) allows an unauthenticated remote attacker to render the server completely unavailable with minimal effort. The GET /hot-reload endpoint in debug mode enters an unbounded loop controlled by the attacker-supplied counter parameter, holding worker threads indefinitely until the thread pool is exhausted and the server stops responding to all requests. Recovery requires a manual server restart. No public exploit has been identified at time of analysis, but the attack mechanism is trivially simple and fully automatable.
Unauthenticated arbitrary file write in DB-GPT 0.8.0 lets remote attackers achieve remote code execution through the skill_upload endpoint, which builds an upload path by joining the user-controlled multipart filename to the upload directory without canonicalisation or containment checks. Because the route's only auth dependency (get_user_from_headers) returns an admin-role request even when no credentials are supplied, an attacker with no account can write a .py file such as ../../../tmp/x or /tmp/x anywhere the server process can write, then plant or overwrite a Python module that executes when next imported. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV, but the flaw is trivially exploitable and fixed in v0.8.1.
Unauthenticated remote code execution in Chainlit (2.4.0rc0 through 2.11.x) occurs when features.mcp.enabled is set to true, exposing the POST /mcp endpoint that accepts a user-controlled stdio command string. Because the allowlist only validates the executable name and passes arguments unchecked, an attacker can supply 'npx -y -c <payload>' to run arbitrary shell commands as the Chainlit process. Publicly available exploit code exists (working PoC from the reporting researchers and in the advisory); it is not listed in CISA KEV, and MCP has been disabled by default since v2.7.0, limiting the exposed population.
Remote code execution in Amazon Strands Agents Tools before 0.8.5 lets an attacker abuse the python_repl tool to run arbitrary Python on the agent's host by defeating its human-in-the-loop consent gate. A crafted prompt smuggles the non_interactive_mode flag as a keyword argument through the batch tool, causing python_repl to execute without operator approval. No public exploit has been identified at time of analysis, but the CVSS 4.0 base score is 9.2 (Critical) given full confidentiality, integrity, and availability impact on the host.
CPU exhaustion denial-of-service in eml_parser (Python pip package, versions prior to 3.0.2) stems from a quadratic-time regex fix-point loop in the `noparenthesis` function used to strip parenthesized CFWS comments from `Received:` email headers. Remote, unauthenticated attackers can submit small, specially crafted EML files containing deeply nested parentheses that consume multiple seconds of CPU time per parsed message, degrading throughput and causing queue backpressure or service-level outages in synchronous email gateways, sandboxes, and real-time triage pipelines. No public exploit has been identified at time of analysis, but the attack is trivially reproducible from first principles using only the published advisory description.
Remote code execution in qwed 5.1.1 allows any authenticated tenant to execute arbitrary Python code inside the API server process by submitting crafted mathematical expressions to the POST /verify/math or POST /verify/batch endpoints. User accounts are freely self-registerable via the default-enabled /auth/signup endpoint - no invitation code or administrator approval required - making the effective exploitation barrier nearly equivalent to unauthenticated. A complete, functional proof-of-concept exploit script is publicly available in the GitHub advisory (GHSA-q27q-98j4-9pfv), and a vendor-released patch is available in version 5.1.2.
Authentication bypass in djust's WebSocket LiveView consumer allows unauthenticated remote clients to invoke protected event handlers on views gated by login_required, permission_required, or redirecting on_mount hooks. All djust versions prior to 1.0.4 are affected: handle_mount sends a navigate/redirect frame on auth denial but neither closes the WebSocket nor clears self.view_instance, leaving the socket open and exploitable. Because handle_event never rechecks authentication after mount, a non-browser WebSocket client that ignores the redirect can send arbitrary event frames and execute state-mutating or data-reading handlers without an authenticated session. No public exploit identified at time of analysis beyond the WebsocketCommunicator proof-of-concept reproducer disclosed in GHSA-xx4j-w367-7247; this vulnerability is not listed in CISA KEV.
Arbitrary OS command execution in mcp-shell's default Docker image allows any MCP tool caller to bypass the secure-mode executable allowlist by supplying `/bin/bash -c <payload>` to the `shell_exec` tool, running commands as `mcpuser` (UID 1000) inside the container. The validator in `security.go` extracts only the first whitespace-delimited token as the executable, approves `/bin/bash` against the default allowlist, and passes the `-c` flag through the metacharacter check unchallenged because the default `blocked_patterns` array is empty. A fully working PoC is included in the GitHub Security Advisory GHSA-3x77-wg38-92r3; no public exploit identified at time of analysis beyond the researcher-provided PoC, and no CISA KEV listing exists. Vendor-released patch v0.6.0 is confirmed.
OS command injection in mcp-shell's 'secure mode' allows any MCP client to execute arbitrary shell commands by exploiting Git's runtime alias mechanism. The security validator in security.go blocks common shell metacharacters but omits '!', the prefix Git uses to invoke shell aliases via '-c alias.NAME=!CMD'. Because /usr/bin/git is in the default allowed_executables list and the CVSS PR:N vector confirms no authentication is required, all default Docker deployments (mcpuser, UID 1000, Git pre-installed) are exploitable by any entity with MCP connectivity. A fully functional PoC is published in the GHSA advisory; no CISA KEV listing is present at time of analysis.
Arbitrary code execution in QWED-MCP before 0.2.1 stems from its verify_math_expression() library function feeding attacker-controlled expression and claimed_result strings into SymPy's parse_expr() with an unrestricted built-in namespace, turning a math-verification routine into a Python eval() sink. Any downstream integration that forwards untrusted input to this public API lets an attacker run OS commands as the qwed-mcp process user (root-level RCE confirmed in a container by the vendor advisory). Publicly available exploit code exists via the GHSA advisory PoC, but this is not listed in CISA KEV; the published CVSS is 9.8 while real reach depends on how the library is wired up.
PraisonAI's async Jobs API FastAPI service exposes all seven `/api/v1/runs` endpoints - submit, list, status, result, cancel, delete, and stream - with zero authentication on every route, allowing any network-reachable caller to execute arbitrary prompts against the operator's configured LLM credentials and enumerate or exfiltrate cross-tenant job outputs. Publicly available exploit code is documented in GHSA-2jgc-f764-c5r2, with all five attack primitives confirmed via proof-of-concept returning HTTP 202/200/204 with no credentials. This is a distinct, unpatched sibling of CVE-2026-44338 - the Flask server fix at 4.6.34 did not touch the FastAPI jobs module, which remained fully unauthenticated through version 4.6.51.
Server-Side Request Forgery in PraisonAI's Jobs API (pip/praisonai < 4.6.58) results from two compounding flaws: a fail-open DNS error handler in `JobSubmitRequest.validate_webhook_url()` that silently accepts any webhook URL when `socket.gaierror` is raised, and a TOCTOU race where `JobExecutor._send_webhook()` performs a completely independent DNS resolution via `httpx.AsyncClient` minutes to hours after validation. Authenticated attackers with a valid API bearer token can submit a job whose `webhook_url` hostname returns NXDOMAIN at validation time, then update DNS to a private IP before job completion, causing the executor to POST job result data to internal infrastructure. A detailed proof-of-concept is publicly available in GHSA-rg5q-pp8p-f7jm; no public exploit identified at time of analysis beyond the PoC, and this CVE is not listed in CISA KEV.
Authentication bypass in PraisonAI's HTTP agent-serving layer allows unauthenticated remote invocation of registered agents despite the operator having configured an API key via --api-key. The root defect is in _create_agents_app(): it never reads config["api_key"] and never attaches a FastAPI Depends() auth dependency to POST /agents and POST /agents/{agent_name}, making the advertised --api-key flag a no-op. A public proof-of-concept confirms HTTP 200 responses to credentialless requests on all agent invocation routes while sibling /api/v1/ routes correctly return 401; no CISA KEV listing was identified at time of analysis.
Workspace boundary escape in PraisonAI's praisonai.code CODE_TOOLS exposes three independent path traversal vectors affecting all file operation and command execution tools exported for use by AI agents. Agents configured with a workspace parameter - intended as a filesystem security boundary - can be manipulated via prompt injection or untrusted input to read, write, enumerate, and execute commands outside that boundary, bounded only by the process user's OS permissions. Publicly available proof-of-concept code demonstrates all six bypass paths against real praisonai.code agent tools; no CISA KEV listing exists at time of analysis.
Server-Side Request Forgery in praisonaiagents (pip package, versions < 1.6.58) allows any attacker who can influence an AI agent's crawl target - via crafted task instructions or prompt injection embedded in previously crawled content - to exfiltrate cloud instance metadata (including IAM credentials), internal localhost services, and RFC1918 API endpoints. The web_crawl tool's SSRF protection validates only the initial URL's hostname IP, then invokes httpx with follow_redirects=True, allowing an attacker-controlled public URL to 302-redirect the agent to 169.254.169.254 or 127.0.0.1 without any re-validation. This is an incomplete fix for a prior SSRF class in the same component. A fully functional proof-of-concept is publicly documented in GHSA-5r34-2g38-6569, and no public exploit identified at time of analysis beyond the PoC; no CISA KEV listing is present.
Arbitrary code execution in NLTK (Natural Language Toolkit) through 3.9.4 allows attackers to run Python code when a victim application loads a malicious transition-parser model file. The TransitionParser.parse() method deserializes model data via pickle with restricted=False, so an attacker-supplied model embedding pickle gadget chains executes with the privileges of the loading process. No CISA KEV listing or public exploit code is identified at time of analysis, though this class of pickle-RCE bug is trivially weaponizable once a malicious model is delivered.
Denial-of-service in Mistune Python Markdown parser versions 3.3.0-3.3.2 allows remote unauthenticated attackers to crash any process that renders user-supplied Markdown by submitting input with hundreds of consecutive asterisk characters. The recursive HTMLRenderer.render_token() traversal grows proportionally to emphasis nesting depth and exceeds Python's default recursion limit, raising an unhandled RecursionError that terminates the parsing process. No public exploit identified at time of analysis, though the fix commit itself demonstrates the attack pattern explicitly in its regression test suite.
Insecure file creation in RansomLook (≤ 2.0.0) exposes the Flask session-signing secret to any local OS user with read access to the application home directory, enabling complete authentication bypass. The secret key governs Flask session cookie signing and the legacy API-key derivation function; possession of it allows an attacker to forge valid session cookies and impersonate any user, including administrators. In LDAP-configured deployments, exploitation is especially direct because the session user loader accepts arbitrary usernames without verifying their existence against any user store. No public exploit has been identified at time of analysis.
Unsafe pickle deserialization in Flair 0.15.0 and 0.15.1 allows arbitrary code execution with the privileges of the loading process when a victim calls ClusteringModel.load() on an attacker-supplied model file. The critical compounding factor is a false remediation: CVE-2024-10073 designated 0.15.0 as the fixed version after clustering was dropped from the documented API, but flair/models/clustering.py remains physically present in the PyPI-distributed wheels for both 0.15.0 and 0.15.1 and is directly importable, voiding the prior CVE's resolution. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Remote code execution in Xinference (all versions before 2.12.0) allows any user with model-launch access to execute arbitrary Python code on the server at worker-process privilege level. Six model loader call sites across the rerank, embedding, and LLM subsystems hardcode trust_remote_code=True when invoking Hugging Face AutoTokenizer.from_pretrained, meaning a registered model with an attacker-controlled path can ship a malicious tokenizer_config.json whose auto_map entries are imported and executed unconditionally upon model load. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but any Xinference deployment that permits user-defined model registration is exposed without the 2.12.0 patch.
Unbounded recursion in NLTK's JSONTaggedDecoder.decode_obj() (nltk/jsontags.py) allows unauthenticated remote attackers to crash the Python process by submitting a deeply nested JSON payload exceeding Python's default recursion limit of 1000. All NLTK releases before 3.9.4 are affected; exploitation depends on whether the calling application exposes JSONTaggedDecoder to externally-supplied JSON input. A public proof-of-concept is included in the GHSA advisory; no confirmed active exploitation (CISA KEV) has been identified at time of analysis.
Remote code execution in Xorbits Inference (Xinference) 2.5.0 and earlier lets a remote attacker run arbitrary OS commands in the server process by abusing an unsafe eval() in the Llama3 tool-call parser. Any request to the OpenAI-compatible /v1/chat/completions endpoint with a tools field triggers evaluation of model-generated Python, so an attacker who steers the model's output via a crafted prompt achieves full server compromise; because authentication is disabled in the default deployment, the vendor advisory rates this exploitable by an unauthenticated remote attacker. This is fixed in 2.7.0; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Arbitrary code execution in Facebook Research Hydra prior to version 1.3.4 allows any party who can supply untrusted configuration - including YAML config files, CLI overrides, or ML model metadata - to invoke dangerous Python callables through hydra.utils.instantiate(). The vulnerability stems from _resolve_target() accepting any Python callable path without restriction, enabling an attacker to trigger functions such as os.system, subprocess.Popen, or builtins.exec inside the consuming application's process. No public exploit code has been identified at time of analysis, and no CISA KEV listing exists; the upstream fix is confirmed shipped in v1.3.4.
Remote code execution in Omnigent's multi-tenant runner allows any authenticated user to hijack the runner process by uploading a crafted agent bundle that specifies a dotted Python import path (e.g., subprocess.check_output) as a server-side callable tool. The server's bundle validator failed to inspect the callable field, so the runner blindly imported and executed the specified Python symbol with its own process permissions. All Omnigent deployments prior to version 0.3.0 running in shared or multi-tenant mode are affected; no public exploit has been identified at time of analysis, though the GHSA advisory and fix PR provide a detailed exploitation roadmap.
Uncontrolled recursion in django CMS prior to 5.0.8 allows an authenticated staff user to corrupt the plugin tree and deny service by exploiting a missing cycle guard in the move_plugin endpoint. By supplying the plugin's own primary key or a descendant's ID as the plugin_parent value in a crafted POST request, the attacker creates a parent-child cycle that causes the _get_descendants_cte and _get_ancestors_cte recursive CTE queries to loop indefinitely, exhausting database recursion limits and consuming web request workers. The same 5.0.8 release also patches a related information disclosure path where clipboard copy operations lacked source-side permission checks, allowing a staff user to exfiltrate plugin content from placeholders they have no access to - consistent with the 'Information Disclosure' tag on this advisory. No public exploit identified at time of analysis.
Remote denial-of-service in vouch-proxy v0.47.2 and earlier crashes the server process with a single unauthenticated HTTP request. The /validate endpoint's multipart cookie reassembly routine in pkg/cookie/cookie.go parses the total part count directly from the attacker-controlled Cookie header name - an N value of 10 billion passed as VouchCookie_1of10000000000 triggers a make([]string, N) call requesting approximately 160 GB of heap, immediately raising a Go runtime fatal out-of-memory error. No authentication, session token, or prior interaction is required; a fully working PoC with Docker reproduction artifacts is publicly disclosed in the GitHub Security Advisory, though no CISA KEV listing is confirmed at time of analysis.
Arbitrary code execution in aeon 1.3.0 is triggered when a user loads a maliciously crafted CSV dataset file via the `load_time_series_segmentation_benchmark` or `load_human_activity_segmentation_datasets` functions, both of which passed CSV column values directly to Python's `eval()` built-in without validation. An attacker who convinces a data scientist or researcher to open a crafted dataset file can execute arbitrary Python code with the privileges of the running process. No public exploit has been identified at time of analysis, but the upstream fix commit is public and the vulnerability class is trivially replicable given the use of bare `eval()`.
Remote code execution in aeon 1.3.0 is possible when a user loads a maliciously crafted CSV dataset via the `load_human_activity_segmentation_datasets` or `load_time_series_segmentation_benchmark` functions, which pass unvalidated column values directly to Python's `eval()`. An attacker who can deliver a malicious file or dataset URL to a target data scientist can execute arbitrary Python code in the victim's process with their full privileges. No public exploit has been identified at time of analysis, though ZDI (ZDI-CAN-29160) holds technical details; the upstream fix replacing `eval()` with `ast.literal_eval()` is available as a commit but a tagged patched release has not been independently confirmed.
Arbitrary file read, write, and Python code execution in Agno's PythonTools (agno.tools.python) exposes any file accessible to the agent process via path traversal sequences injected into the file_name argument of read_file, save_to_file, or run_python_file. The root cause is use of Path.joinpath() without resolving or validating the resulting path against the intended base_dir boundary, enabling escape via sequences such as '../../../../../../etc/passwd'. No public exploit has been identified at time of analysis, but the attack is trivially constructible and can be delivered through direct tool invocation or prompt injection embedded in agent-processed content, giving any untrusted input source a path to OS-level code execution within the agent process.
Remote code execution on the Wazuh cluster master node is achievable by any attacker who controls a cluster worker node, exploiting unsafe Python builtin resolution in the distributed API merge path. Affected versions span 4.0.0 through 4.14.5 and 5.0.0-beta1; the vulnerable code in framework/wazuh/core/results.py called getattr(builtins, type_) with attacker-supplied strings from worker JSON responses, enabling exec or eval injection. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the attack primitive is mechanically trivial once a worker node is controlled, with the payload executing as root on the master.
Authenticated remote code execution affects Talebook (MyBooks/PoxenStudio) ebook management server versions 3.41.2 and earlier, where an administrator can inject arbitrary Python into the auto-generated auto.py settings module via a crafted SOCIAL_AUTH key name. Because the server imports auto.py as a live module and can auto-restart to reload it, injected statements execute with the service account's privileges, enabling data disclosure, file modification, persistence, or service disruption. No public exploit is identified at time of analysis; the fix is version 3.42.0, and chained authorization/registration weaknesses noted by the vendor could lower the effective privilege barrier.
Cross-dataset authorization bypass in GeoLens prior to 1.2.3 allows unauthenticated network callers and low-privileged authenticated users to read private dataset content - including vector tile geometries, raster pixels, backing-table rows, column schemas, and sampled values - that they have no access to. The root flaw is a consistent pattern across six distinct endpoints: the API authorizes the resource named in the URL but fails to re-authorize a second, caller-influenced dataset reached through a relationship, layer reference, VRT mosaic, or request body. No public exploit has been identified at time of analysis, but the most severe findings require zero authentication, making them trivially exploitable by any network-reachable caller.
Server-side request forgery in the Red Hat Ansible Automation Platform 2 Controller's HashiCorp Vault credential plugin lets an authenticated user with credential-creation rights force the controller pod to leak its own Kubernetes service account token. When a HashiCorp Vault Secret Lookup credential configured for kubernetes_role authentication is tested, the kubernetes_auth() routine in awx_plugins/credentials/hashivault.py transmits the pod token to an attacker-supplied URL. With that token the attacker gains Kubernetes API access to control-plane namespaces, enabling full pod CRUD and secret reads including database credentials and the Django SECRET_KEY. No public exploit identified at time of analysis, and the flaw is not on the CISA KEV list.
Remote code execution in CodeWhale (packages codewhale and codewhale-tui) versions 0.8.41 through 0.8.63 allows an attacker to execute arbitrary Python code on the victim's machine by exploiting a hardcoded approval bypass in the rlm_eval built-in tool. The tool's approval_requirement() method returned ApprovalRequirement::Auto, causing the engine to silently skip user approval prompts regardless of the operator's configured --approval-policy, enabling prompt injection attacks through any external content the agent reads. No public exploit has been identified at time of analysis, but the attack surface encompasses any CodeWhale agent workflow that fetches untrusted content such as web pages, repository files, or MCP tool results.
Arbitrary Python code execution in FreeCAD's BIM module (versions 0.19 through pre-1.1.1) is triggered when a user opens a malicious project template file through the BIM Project Manager's Load Template function. The loadTemplate() method in BimProjectManager.py passes FCStd metadata fields (wpposition, wpu, wpv, wpaxis) directly to Python's built-in eval(), enabling an attacker who can deliver a crafted template to achieve full code execution under the victim's user account. No public exploit has been identified at time of analysis; the vendor-released patch is confirmed in version 1.1.1.
Arbitrary Python code execution in FreeCAD's BIM Workbench (versions 0.19 through 1.1.0) is triggered when a user creates a TechDraw page from a malicious SVG template, due to an unsafe eval() call in BimTDPage.py at line 87. Exploitation requires social engineering - an attacker must deliver a crafted SVG template to a victim who then performs the TechDraw page creation action. No public exploit has been identified at time of analysis and no CISA KEV listing exists, but the vulnerability is structurally trivial (direct eval of attacker-controlled input, CWE-95) and the fix is available in version 1.1.1.
Remote code execution via crafted .FCStd document in FreeCAD prior to 1.1.2 allows arbitrary Python execution when a victim opens a malicious file. The deserialization path in PropertyPythonObject::Restore() passes attacker-controlled module names directly to PyImport_ImportModule(), executing module-level Python code on import; the legacy pickle branch additionally invokes an attacker-controlled class constructor via PyObject_CallObject(). No public exploit or CISA KEV listing is identified at time of analysis, but exploit construction is straightforward for any researcher who can craft the FCStd XML schema.
Quadratic CPU consumption in sqlparse versions prior to 0.6.0 allows unauthenticated remote denial-of-service via crafted deeply-nested SQL payloads submitted to any application calling sqlparse.parse(), sqlparse.format(), or sqlparse.split(). A ~2KB malicious input with 500-2000 nesting levels can consume approximately 10 seconds of CPU per request - a ~5000x amplification ratio - before depth or token limits raise a SQLParseError. No active exploitation is confirmed in CISA KEV, though the GHSA advisory includes a detailed proof-of-concept demonstrating the attack; CVSS 4.0 rates availability impact as High (8.7) with no authentication required.
CPU exhaustion via ReDoS in sqlparse affects all Python applications that pass caller-controlled SQL text to sqlparse.parse(), sqlparse.format(), or sqlparse.split() prior to version 0.6.0. The root cause is a backreference regex pattern in the dollar-quoted literal lexer that, combined with the per-position lexer loop, produces O(n²) CPU complexity when processing inputs containing many unique, unclosed dollar-quote openers or multiline comment delimiters — making it trivially exploitable from the network with no authentication. No public exploit code or CISA KEV listing has been identified at time of analysis, but the fix commit includes a purpose-built benchmark script that doubles as a functional reproduction guide.