IBM Planning Analytics versions 2.0 and 2.1 Local are affected by a Cross-Site Request Forgery (CSRF) vulnerability. This flaw could allow an attacker to trick a user into executing unauthorized actions on the affected system. The vulnerability does not impact confidentiality but can lead to high integrity impact and low availability impact.
Cross-Site Request Forgery (CWE-352) in Kibana can lead to privilege escalation via Cross Site Request Forgery (CAPEC-62). A user who is permitted to create visualizations can save a specially crafted Vega visualization that, when it is opened by another user, causes authenticated requests to be issued to Kibana in the context of the viewing user's session.
In Zimbra Collaboration (ZCS) before 10.1.17, a Cross-Site Request Forgery (CSRF) vulnerability exists in the Exchange Web Services (EWS) endpoint of Zimbra Collaboration (ZCS) due to insufficient validation of request content types. An attacker can exploit this vulnerability by causing an authenticated user to submit a crafted request, potentially allowing unauthorized actions to be performed on behalf of the victim.
HCL AION is affected by a vulnerability where JavaScript responses containing data could be referenced by external pages, potentially allowing sensitive information to be captured by an attacker-controlled page (JavaScript hijacking) under certain conditions.
The ShopEngine Elementor WooCommerce Builder Addon WordPress plugin before 4.9.3 does not protect one of its authentication endpoints against CSRF, allowing an attacker to log a victim into an attacker-controlled account, so that the billing and shipping details the victim then enters at checkout are stored under and readable by the attacker.
Astro is a web framework for content-driven websites. From 7.0.0 until 7.0.6, the composable astro/hono pipeline installs security.checkOrigin only through the middleware() primitive, while actions() and pages() can dispatch to user code independently. Mounting actions() before middleware(), as in the examples/advanced-routing example and Cloudflare Hono documentation, allows cross-origin form-encoded action requests to execute before the origin check, and using pages() without middleware() drops the check for on-demand endpoints and pages. The flaw enables blind write-only cross-site request forgery using the victim's cookies against ActionHandler.handle and PagesHandler.handleWithErrorFallback when manifest.checkOrigin is enabled; the attacker can trigger a state-mutating action or endpoint handler but cannot read the cross-origin response. The default non-composable astro() pipeline is not affected. This issue is fixed in version 7.0.6.
Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.21, the /api/users/{id}/password endpoint accepts a cross-site request using the authenticated user's semaphore session cookie without CSRF protection or current-password confirmation, allowing an unauthenticated attacker to change an administrator's or another user's password after user interaction. This issue is fixed in version 2.18.21.
### Summary
`npx claude-code-templates --studio` launches "Claude Code Studio", an Express HTTP server (`cli-tool/src/sandbox-server.js`, default port 3444) that binds to **all interfaces** (`0.0.0.0`), sets `Access-Control-Allow-Origin: *`, and requires **no authentication**. Two POST endpoints pass attacker-controlled request-body fields into `child_process.spawn(..., { shell: true })`. Because `shell: true` makes Node join the argv array into a single `sh -c` string, the fields are parsed by the shell and metacharacters execute. Any unauthenticated attacker who can reach the port — a malicious web page the developer visits, or anyone on the same LAN — can execute arbitrary OS commands on the developer's machine.
### Details
In `cli-tool/src/sandbox-server.js`:
- `app.listen(PORT, ...)` is called with no host argument, so the server listens on `0.0.0.0` / `::` (reachable from the LAN, not just localhost).
- The CORS middleware sends `Access-Control-Allow-Origin: *` and answers the preflight `OPTIONS` for any origin, so a browser will deliver cross-origin POSTs to it.
- There is no authentication on any endpoint.
The vulnerable sinks:
1. `POST /api/execute` — the `prompt` body field flows into `executeLocalTask()`:
```js
const child = spawn('claude', [finalPrompt], { /* ... */ shell: true });
The only validation on prompt is a length check (>= 10 chars). With shell: true, finalPrompt is interpreted by the shell.
2. POST /api/install-agent — the agentName body field:
const child = spawn('npx', ['claude-code-templates@latest', '--agent', agentName, '--yes'], { /* ... */ shell: true });
2. agentName is used unvalidated. (The same unsafe pattern is also reachable through /api/execute's agent field via checkAndInstallAgent().)
Root cause: spawn(cmd, argsArray, { shell: true }) does not keep argsArray as separate argv entries — Node builds cmd + ' ' + argsArray.join(' ') and runs it via sh -c, so every element is subject to shell parsing.
PoC
# Victim
npx claude-code-templates --studio # server on 0.0.0.0:3444
# Attacker (another LAN host, or a malicious web page fetch(), or locally)
curl -s -X POST http://127.0.0.1:3444/api/execute \
-H 'Content-Type: application/json' \
--data '{"prompt":"aaaaaaaaaa; touch /tmp/CCT_RCE_PROOF","mode":"local"}'
curl -s -X POST http://127.0.0.1:3444/api/install-agent \
-H 'Content-Type: application/json' \
--data '{"agentName":"x; touch /tmp/CCT_AGENT_PROOF #"}'
ls -la /tmp/CCT_RCE_PROOF /tmp/CCT_AGENT_PROOF # both created => injected commands ran
The aaaaaaaaaa padding satisfies the 10-char minimum, then ; (or $(...), or backticks) starts the injected command. claude/npx do not even need to be installed — the injected segment runs regardless.
Confirmed at runtime on v1.28.13 (Node 22, Linux): both marker files were created, the server listened on *:3444, and an OPTIONS preflight from Origin: https://evil.example returned 200 with Access-Control-Allow-Origin: *.
Impact
Unauthenticated remote code execution (CWE-78) on any machine running --studio. Two reachability paths:
- Drive-by: a developer running --studio who visits an attacker-controlled web page — the page's cross-origin fetch() (Content-Type application/json) passes the wildcard CORS preflight and delivers the POST, achieving RCE with no other interaction.
- LAN: because the server binds 0.0.0.0, anyone on the same network (office, co-working space, public Wi-Fi) can hit port 3444 directly.
Impact is full compromise of the developer's user account (arbitrary command execution with the developer's privileges): source code, SSH keys, cloud credentials, and .env secrets.
Suggested fix
- Remove shell: true from all three spawns so arguments stay discrete argv entries (kills the injection).
- Validate agentName against a strict allowlist (^[A-Za-z0-9._/-]+$).
- Bind to loopback only (app.listen(PORT, '127.0.0.1', ...)).
- Replace the wildcard CORS with a same-origin allowlist and reject other origins.
Affected versions of MISP cti-transmute expose several state-changing account operations as GET requests:
*
/account/follow
*
/account/delete_notification
*
/account/mark_notification_read
*
/account/mark_all_read
These endpoints require authentication, but before the fix they could be invoked with simple GET requests. That makes them susceptible to cross-site request forgery because a third-party site can induce the victim’s browser to send authenticated GET requests automatically.
The patch converts the actions to POST or DELETE and updates the frontend to include an X-CSRFToken header, providing explicit CSRF protection for those state-changing operations.
### Problem
The referrer enforcement introduced with [TYPO3-CORE-SA-2020-006](https://news.typo3.com/security/advisory/typo3-core-sa-2020-006) ([CVE-2020-11069](https://www.cve.org/CVERecord?id=CVE-2020-11069)) became ineffective in TYPO3 v13.0, where TYPO3 CMS started serving the backend and Admin Tool applications from the site's main entry script instead of the dedicated typo3/ directory.
Whether a request originated from the backend or Install Tool itself was determined by comparing the referrer against the directory of the entry script, which since then is the site root. As a consequence, requests originating from any script running on one of the TYPO3 instance's own domains, such as a frontend page, were accepted by backend routes and Install Tool endpoints.
Attackers able to execute JavaScript on one of those domains, for instance by exploiting a cross-site scripting vulnerability, could invoke these endpoints via Fetch/XHR with the privileges of an authenticated victim's user session.
### Solution
Update to TYPO3 versions 13.4.34 LTS, 14.3.6 LTS that fix the problem described.
### Credits
Thanks to Hổ Cao Từ for reporting this issue, and to TYPO3 core & security team member Benjamin Franzke for fixing it.
SAP Approuter does not enforce cross-site request forgery protection on the authentication flow by default. An unauthenticated attacker could craft a malicious link and trick a victim into following it. Successful exploitation could allow the attacker to bind the victim's session to an attacker-controlled identity, resulting in a low impact on integrity. There is no impact on confidentiality and availability.
Cross-Site Request Forgery weaknesses in the Administrative Console of PingFederate versions before version 13.1 may allow actors to perform unauthorized actions via specially-crafted links triggered by administrators with active sessions.
CVE-2026-72578 is a high-severity cross-site request forgery (CSRF) vulnerability in FreePBX Framework version 17.0. It allows an unauthenticated remote attacker to perform administrative actions by exploiting the privileges of an authenticated administrator. The vulnerability has a CVSS score of 8.8, indicating a significant risk to confidentiality, integrity, and availability. No official patch or remediation guidance has been provided yet.
The Advanced Classifieds & Directory Pro Advanced Classifieds & Directory Pro WordPress plugin before 3.4.3 (<= 3.4.2) is vulnerable to unauthenticated sensitive information exposure via the AJAX action `acadp_public_custom_fields_listings`.
The Solace Extra WordPress plugin before 1.6.1 does not perform capability or nonce checks in one of its AJAX actions, allowing any authenticated user such as a subscriber (and, via CSRF, any logged-in user) to update post meta on arbitrary posts and to deactivate the site's active templates.
CVE-2026-16262 is a Cross-Site Request Forgery (CSRF) vulnerability in the Estatik Real Estate Plugin for WordPress before version 4.3.3. The flaw allows an unauthenticated attacker to log a victim into an attacker-controlled account by exploiting the OAuth social login flow, which is not properly bound to the initiating user session. This causes the victim's subsequent activity to be associated with and accessible by the attacker. The vulnerability has a high severity rating with a CVSS score of 7.5.
CVE-2026-66686 is a medium severity vulnerability in Vladimir Garagulya's Plugins Garbage Collector (Database Cleanup) version 0.14 and earlier. It allows unauthenticated Cross-Site Request Forgery (CSRF) attacks, which can cause unauthorized modification of data. The vulnerability does not affect confidentiality or availability but impacts data integrity. No official patch or remediation guidance is currently available from the vendor.
CVE-2026-66681 is a medium severity vulnerability involving an unauthenticated Cross-Site Request Forgery (CSRF) in the Theme My Login plugin version 7.1.14 and earlier. This vulnerability allows an attacker to induce a logged-in user to perform unwanted actions without their consent. The vulnerability does not impact confidentiality or availability but can lead to integrity issues. No official patch or remediation guidance is currently available from the vendor. No known exploits are reported in the wild.
CVE-2026-28172 is a high-severity Cross-Site Request Forgery (CSRF) vulnerability affecting Data443 Risk Mitigation, Inc.'s Tracking Code Manager versions up to and including 2.6.0. The vulnerability allows unauthenticated attackers to perform actions on behalf of a user by exploiting CSRF weaknesses. No official patch or remediation guidance is currently available from the vendor. The vulnerability has a CVSS 3.1 score of 7.1, indicating a significant risk due to its network attack vector and impact on confidentiality, integrity, and availability.
CVE-2025-13394 is a Cross-Site Request Forgery (CSRF) vulnerability in the Ajax processor of the Carbon console within WSO2 Identity Server. The vulnerability arises because state-changing operations use the HTTP GET method and rely on the SameSite=Lax cookie attribute for CSRF mitigation, which can be bypassed. This allows attackers to trick authenticated users into unknowingly performing unauthorized actions. Exploitation requires the Carbon console and related services to be publicly accessible, which is against WSO2's security recommendations.