CWE-427: Uncontrolled Search Path Element vulnerabilities

CVE-2026-89325 is a high-severity vulnerability in Rapid7 Insight Agent on Windows involving an uncontrolled search path element. A local, low-privileged user can execute arbitrary code as SYSTEM by placing a malicious executable named 'code' in a writable directory that appears earlier in the machine PATH than the legitimate Visual Studio Code. This affects all Insight Agent versions running assessment content at or below version 0.0.261.0. The issue was fixed in assessment content version 0.0.269.0, which was automatically deployed, requiring no customer action.

IBM Concert 1.0.0 through 3.0.0 invokes operating system commands without fully qualifying executable paths or adequately restricting search path resolution. As a result, an attacker with local system access can manipulate the search path environment to execute untrusted or malicious code.

A local privilege escalation vulnerability exists in the updater of Foxit PDF Editor/Reader due to unsafe loading of dynamic-link libraries from a user-writable directory during high-privilege operations. A local attacker could exploit this issue to execute code with elevated privileges.

A local cross-user code execution vulnerability exists in GNU wget (Windows builds from eternallybored.org) due to a hardcoded configuration file path (C:\msys64) that is writable by unprivileged users, allowing for arbitrary code execution via the use_askpass directive, potentially allowing local privilege escalation.

Privilege escalation due to weak configuration during package extraction process.

CVE-2026-54916 is a high-severity vulnerability in the netbox-community devicetype-library, a collection of community-sourced device type definitions for NetBox. The issue arises from Python import path manipulation during test collection, allowing an unauthenticated contributor to add malicious modules that shadow legitimate ones. This enables arbitrary code execution on GitHub Actions runners, potentially leading to test-result tampering and unauthorized access to tokens or network resources. The vulnerability is fixed by a specific commit that addresses the import path handling.

Dell Server Update Utility, versions prior to 26.07.01, contains an Uncontrolled Search Path Element vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Code execution.

CVE-2026-92838 is a DLL hijacking vulnerability in GeoVision Inc.'s GV-Remote E-map desktop application version 18.3.1. The application loads dynamic-link libraries from an unsafe search path, which allows a local attacker with write access to place a malicious DLL in a location searched before the legitimate one. Successful exploitation can lead to arbitrary code execution within the security context of the GV-Remote E-map process.

CVE-2026-92180 is a local privilege escalation vulnerability in pdfforge PDF Architect version 9.1.90.23122. The flaw exists in the activation-service process, which loads a library from an unsecured location, allowing an attacker with low-privileged code execution to escalate privileges to SYSTEM. This vulnerability has a high severity rating with a CVSS score of 7.8.

Adobe Photoshop 2026 contains an Uncontrolled Search Path Element vulnerability (CWE-427) that could allow an attacker to execute arbitrary code with the privileges of the current user. Exploitation requires user interaction, specifically opening a malicious file. The vulnerability affects versions up to and including 27.6 and 26.11.6. The scope of the vulnerability is changed, indicating potential impact beyond the initial component.

CVE-2026-72980 is a vulnerability in Microsoft Windows 10 Version 1607 and later versions that affects Windows Hello. It involves an uncontrolled search path element that allows an authorized local attacker to bypass a security feature. The vulnerability has a medium severity rating with a CVSS score of 4.4. Official patches have been released to address this issue in multiple Windows 10 builds.

OpenAI Codex Desktop for Windows and macOS could execute attacker-controlled Git hooks because automated Git operations trusted the repository's local core.hooksPath setting. If a user opens an attacker-prepared repository whose preserved .git/config points core.hooksPath to an attacker-controlled directory, Codex can run a malicious hook while processing the repository. The hook executes outside Codex's command sandbox, without user approval, and with the user's privileges, allowing it to read, change, or delete the user's files and access other resources available to the user's account. An ordinary Git clone does not preserve the attacker-controlled repository-local configuration required for exploitation.

NVIDIA OpenShell for Linux has a critical vulnerability (CVE-2026-65093) involving an uncontrolled search path element (CWE-427). This flaw could allow an attacker to escape a sandbox environment, potentially leading to code execution, privilege escalation, data tampering, and information disclosure. The vulnerability has a high CVSS score of 9.9, indicating severe impact. No specific affected versions or patches are currently documented. There are no known exploits in the wild at this time.

CVE-2026-55013 is a high-severity vulnerability in Microsoft Windows Remote Help involving an uncontrolled search path element. This flaw allows an authorized local attacker to perform spoofing attacks by manipulating the search path used by the application. The vulnerability affects Windows Remote Help versions from 5.0.0.0 up to but not including 5.2.1040.0. A fix has been officially released in version 5.2.1040.0.

CVE-2026-55015 is a vulnerability in Microsoft Windows Remote Help involving an uncontrolled search path element. This flaw allows an authorized local attacker to cause a denial of service condition. The issue affects Windows Remote Help versions from 5.0.0.0 up to but not including 5.2.1040.0. A fix for this vulnerability is available in version 5.2.1040.0. The vulnerability has a medium severity rating with a CVSS score of 5.5.

Dell ObjectScale versions prior to 4.3.0.1 contain an Uncontrolled Search Path Element vulnerability (CWE-427) that allows a low privileged local attacker to potentially elevate privileges. This vulnerability has a high severity with a CVSS score of 7.3. A fix is available in version 4.3.0.1 and later.

A privilege escalation (PE) vulnerability in the Palo Alto Networks Prisma® Access Agent app on Windows and macOS devices enables a local user to execute code with elevated privileges. The Prisma Access Agent on Linux, iOS, Android, and ChromeOS is not affected.

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary code due to an uncontrolled search path element.