Handlebars provides the power necessary to let users build semantic templates. From 3.0.0 until 4.7.10, Handlebars lookupProperty returns Function.prototype.constructor before applying the prototype-access deny list because constructor is an own property of Function.prototype. When an attacker can render a controlled template with allowProtoMethodsByDefault enabled and an accessible function in the template context, the template can traverse from that function through its prototype to Function.prototype and then obtain the Function constructor through the own-property bypass. This permits attacker-controlled JavaScript to execute with the server application's privileges. This issue is fixed in version 4.7.10.
## Summary
Hydra's `instantiate()` API resolves and invokes Python callables named by the `_target_` field in configuration. The target blacklist introduced for CVE-2026-68508 was incomplete.
Representative bypasses included execution wrappers such as `timeit.timeit`, executable deserialization through `pickle.loads`, and generic dispatch or wrapper targets that obscured the effective callable. Target aliases, callable-returning helpers, and deferred dispatch could similarly bypass name-based checks.
An attacker who can cause an application to instantiate an untrusted Hydra configuration can use these gaps to execute code with the application's privileges.
## Fix
Hydra 1.3.6 expands and hardens the blacklist used by the 1.3 compatibility line. It blocks the reported execution and deserialization surfaces, checks canonical callable identities and aliases, mediates callable results, and blocks generic dispatch and wrapper targets that bypass immediate target checks.
The Hydra 1.3 blacklist is a best-effort, defense-in-depth measure. It is not a complete security boundary and does not make untrusted configuration safe to instantiate.
Hydra 1.4.0.dev9 applies the same hardening and introduces the execution whitelist as the recommended primary security boundary. When a whitelist is supplied, targets are rejected unless trusted Python code authorizes them. If no whitelist is supplied, Hydra preserves legacy behavior with a deprecation warning and the blacklist as a best-effort compatibility fallback. Targets that permit configuration to select or supply executable behavior remain non-whitelistable.
## Remediation
Upgrade to Hydra 1.3.6, or to Hydra 1.4.0.dev9 or later when testing the 1.4 prerelease line.
On Hydra 1.3, do not instantiate configuration from untrusted sources. On Hydra 1.4 and later, constrain untrusted configuration with a narrow execution whitelist supplied by trusted Python code.
For Hydra 1.4 execution-whitelist configuration, see: https://hydra.cc/docs/advanced/execution_whitelist/
CVE-2026-106218 is a high-severity vulnerability in JetBrains TeamCity before version 2026.1.3. It involves a Kotlin DSL sandbox escape that could lead to remote code execution (RCE) on the server. The vulnerability is identified as CWE-184, which relates to improper access control. No official patch links are provided in the data, and no known exploits are reported in the wild.
CVE-2026-105791 is a command injection vulnerability in Microsoft UFO, an open-source automation framework. The flaw exists in the run_shell tool of the CommandLineExecutor component prior to version 3.0.9. It improperly validates only the first token of the bash_command parameter and allows explorer.exe to be used, which on Windows can delegate execution to arbitrary executables or scripts. Exploitation requires a user to run an affected agent workflow and trigger the vulnerable tool call. Successful exploitation can lead to arbitrary code execution with the privileges of the desktop user, potentially allowing access or modification of user files, tokens, and sessions. The issue is fixed in version 3.0.9.
Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.9, the execute_command tool in ufo/client/mcp/http_servers/linux_mcp_server.py treats sort and uniq as read-only commands while the free-form command parameter can select their file-output forms. An authenticated caller can use sort -o or the optional second uniq operand to create or overwrite files writable by the UFO server process without shell metacharacters, because the allowed binary opens the destination itself and the argument policy does not reject the operation. This can corrupt configuration or other writable data and disrupt the service, but the demonstrated primitive does not directly disclose files or establish arbitrary code execution. This issue is fixed in version 3.0.9.
CVE-2026-105650 is a cross-site scripting (XSS) vulnerability in the TryGhost Ghost blogging platform affecting versions from 2.5.0 up to but not including 6.64.0. The flaw allows attacker-controlled URLs to embed untrusted scripts in post content, which may execute in the Ghost editor, on published sites, and in newsletter emails. This could lead to compromise of a staff user's administrative session. The issue is fixed in version 6.64.0.
A validation issue in TryGhost Ghost versions 6.0.9 through 6.64.0 allowed unauthenticated users to abuse certain functionality, such as Webmentions, to make limited HTTP requests to hosts within the Ghost server's internal network on some network configurations. The attack does not return response data. The vulnerability is fixed in version 6.65.0.
CVE-2026-100253 is a high-severity vulnerability in JetBrains TeamCity that allows sandbox escape and code execution via the versioned settings Kotlin DSL. It affects versions before 2026.2, including 2026.1.4 and 2025.11.8. The vulnerability is identified as CWE-184 and has a CVSS score of 8.8, indicating a critical impact on confidentiality, integrity, and availability.
CVE-2026-102829 is a critical OS command injection vulnerability in the steveukx git-js package, specifically related to the argv-parser dependency prior to version 2.0.1. The flaw allows an attacker to influence environment variables, causing Git to invoke an attacker-controlled editor during certain Git operations. This can lead to arbitrary command execution with the privileges of the Node.js process running git-js. The issue is fixed in argv-parser version 2.0.1.
A command injection vulnerability exists in the steveukx git-js library (simple-git) versions 3.15.0 through 4.0.0. The default blockUnsafeOperationsPlugin does not treat trailer.<token>.cmd as unsafe, allowing attacker-controlled input via SimpleGitOptions.config or inline -c arguments to execute arbitrary shell commands with the Node.js process's OS permissions. This issue is fixed in version 4.0.1.
fast-mcp-telegram versions prior to 30.1 contain a server-side request forgery (SSRF) vulnerability in the send_message and send_message_to_phone MCP tools. These tools accept files as lists of HTTP(S) URLs, which the server downloads and attaches to outgoing Telegram messages. The URL validation relies on a denylist that checks only the hostname string without DNS resolution, allowing attackers to bypass restrictions and cause the server to fetch resources from internal or private network addresses. This results in a full-read SSRF that can exfiltrate data by returning the fetched content as a Telegram file attachment. The vulnerability is patched in version 30.1.
DBHub is a database MCP server for Postgres, MySQL, SQL Server, Oracle, MariaDB, SQLite. Prior to version 0.22.6, setting `readonly = true` on the `execute_sql` tool does not make the connection read-only. The connectors are written to set PostgreSQL `default_transaction_read_only=on` (and open SQLite in `readOnly` mode), but that code is gated on a config value that is never populated, so it never runs. The only thing left enforcing read-only is a classifier that inspects the first keyword of each statement. Any `SELECT` that writes or has side effects through a function call passes it. With an ordinary role this allows sequence tampering; with a privileged role it allows writing arbitrary files on the server (`lo_export`), reading arbitrary host files (`pg_read_file`), and remote code execution (`dblink` + `COPY ... TO PROGRAM`). The HTTP transport is unauthenticated and binds to `0.0.0.0` by default, so this is reachable by any network caller of `/mcp`. Version 0.22.6 patches the issue.
CVE-2026-97149 is a medium severity vulnerability in OpenStack Swift before version 2.38.2. The tempurl middleware does not reject the X-Copy-From header on PUT requests, allowing an attacker with a valid PUT TempURL to copy any object within the same account. This occurs because the TempURL signature does not cover the X-Copy-From header, and the disallowed headers list is incomplete. The vulnerability affects deployments using the default proxy pipeline with account-level TempURL keys. Cross-account copying is not possible, limiting the scope to the same account.
CVE-2026-84714 is a template injection vulnerability in Red Hat Ansible Automation Platform 2.5 for RHEL 8. The flaw exists in the sanitize_jinja() input-validation function, which inadequately filters user-supplied Jinja expressions, allowing low-privileged users to inject malicious Jinja code. This can lead to arbitrary command execution in the execution environment and unauthorized disclosure of secrets across credential boundaries. The vulnerability affects multiple launch-time fields including ad-hoc command module arguments and credential fields. Red Hat has acknowledged the issue and is pursuing fixes for versions 2.5, 2.6, and 2.7, while version 2.4 is marked as wontfix.
CVE-2026-84706 is a vulnerability in Red Hat Ansible Automation Platform 2.5 for RHEL 8 where the environment-variable injector for custom Credential Types uses an incomplete deny-list. This omission allows privileged users to inject attacker-controlled scripts via process-hijacking loader variables such as BASH_ENV, leading to arbitrary code execution inside the execution-environment container for jobs using such credentials.
CVE-2026-75884 is a critical vulnerability in Red Hat Ansible Automation Platform 2.4 for RHEL 8 involving an incomplete blocklist in the AWX controller's container group pod_spec_override field. This flaw allows an AAP platform administrator to inject unauthorized pod specifications such as initContainers and serviceAccountName overrides, leading to privilege escalation to OpenShift namespace-level access and exfiltration of namespace secrets. Containerized (Podman) installations are not affected. No effective mitigation or patch currently meets Red Hat's criteria for widespread deployment and stability.
MDC is a tool to take regular Markdown and write documents interacting deeply with a Vue component. Prior to 0.22.1, @nuxtjs/mdc uses parseMarkdown with allowDangerousHtml enabled by default and relies on validateProps, validateProp, and unsafeLinkPrefix to remove executable URLs from untrusted Markdown. validateProp checks only attributes named href or src, allowing an SVG xlink:href value represented as xLinkHref to retain a javascript: URL that executes in the page origin when selected. The data:text/html denylist entries are also compared against url.protocol, which is only data:, so an iframe src containing data:text/html survives sanitization and executes in an opaque origin when loaded. Plain href javascript: URLs, srcdoc, object, script, and base elements are already blocked, making these two paths specific sibling gaps in the sanitizer. This issue is fixed in version 0.22.1.
IBM ContextForge MCP Gateway <= v1.0.4 IBM mcp-context-forge could allow an authenticated user to bypass protection mechanisms due to incomplete recursive inspection of nested payload content.
PraisonAI is a multi-agent teams system. From 1.4.0 until 1.7.2, codeMode in src/praisonai-ts/src/tools/builtins/code-mode.ts executes untrusted JavaScript with new Function() inside with(sandbox) and relies on a small source-code blocklist plus shadowed process and require properties. Code can use ({}).constructor.constructor to recover the real Function constructor, obtain process and process.mainModule.require, and reach host filesystem and subprocess APIs despite the advertised sandbox. Attackers who control codeMode input can read secrets, modify files, execute commands, or exhaust the host process. This issue is fixed in version 1.7.2.
An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using ANSI-C quoted arguments. These arguments are not properly inspected, enabling a crafted allowlisted command to execute arbitrary code on the user's system without approval.