— Use of Externally-Controlled Input to Select Classes or Code vulnerability in Apache Jackrabbit's WebDAV/Davex client. A malicious WebDAV/DavEx server, or an attacker able to intercept the connection, can cause the client to instantiate arbitrary classes from its classpath, which can lead to arbitrary file creation or truncation. Only applications that use jackrabbit-spi2dav (directly or through jackrabbit-jcr2dav) to connect to a remote repository are affected. Jackrabbit servers are not affected. Category: unsafe reflection on wire data (HIGH). This issue affects Apache Jackrabbit: from 2.23.0 through 2.23.5, from 2.22.0 through 2.22.4, from 2.20.0 through 2.20.17. Users are recommended to upgrade to versions 2.23.6, 2.22.5, or 2.20.18 which fix the issue.
A high-severity vulnerability (CVE-2026-106440) exists in the hydra-ecosystem hydra framework, specifically in the hydra-optuna-sweeper package versions 1.2.0 up to but not including 1.3.0 and 1.4.0.dev4 up to but not including 1.4.0.dev10. The issue involves unsafe reflection where externally controlled input can specify a dotted path to Python code that is resolved and invoked without proper execution policy enforcement. This allows an attacker controlling Optuna sweep configuration or command-line overrides to execute arbitrary Python code with the application's privileges, bypassing trusted execution whitelists. The vulnerability is fixed in versions 1.3.0 and 1.4.0.dev10.
CVE-2026-106439 is a high-severity vulnerability in hydra-ecosystem's hydra affecting versions 1.3.4 through 1.3.6 and 1.4.0.dev4 through 1.4.0.dev9. It involves unsafe reflection where mutable module-level state used for target blocklists can be manipulated via configuration to remove blocked targets and instantiate them, bypassing intended execution restrictions. The vulnerability affects the legacy/default path without an execution whitelist and allows a configuration controlling multiple sibling _target_ entries to mutate the blocklist and invoke otherwise blocked targets. The issue is fixed in hydra-core 1.3.7 and 1.4.0.dev10. Users are advised to upgrade and avoid passing untrusted configuration to instantiate().
Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Unsafe Reflection and does not sufficiently restrict the code that the mail-processing pipeline could load from an imported rule configuration. An authenticated administrator with mail-rule configuration privileges could cause the gateway to load and execute code beyond the approved set of mail-processing components, potentially in the context of the mail-gateway service account.
Kobako is a Ruby gem embedding a Wasm-isolated mruby interpreter to safely execute untrusted Ruby scripts. Versions from 0.1.0 up to but not including 0.9.1 contain a vulnerability allowing guest scripts to escape the sandbox and execute arbitrary Ruby code in the host process. This vulnerability is identified as CVE-2026-55107 and has been patched in version 0.9.1.
A deserialization vulnerability exists in Amazon GluonTS before version 0.17.0 in the model loading component. This flaw allows attackers who can supply crafted serialized model directories to execute arbitrary operating system commands with the privileges of the loading process. The issue is resolved in version 0.17.0 and later.
Frappe ERPNext versions before 16.34.1 fail to validate that Financial Report Template calculation_formula values reference whitelisted methods before passing them to frappe.call(). Accounts Managers can supply arbitrary dotted Python paths to invoke non-whitelisted internal server-side methods and read their return values.
IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to cause a denial of service due to the improper use of reflection with externally controlled input.
CVE-2026-70410 is a vulnerability in Apache Calcite Avatica before version 1.29.0 involving unsafe reflection. The issue arises from plugin instantiation methods that allow arbitrary classes to be initialized via Class.forName(String), potentially triggering static initializer blocks. Although no known dangerous static initializers are widely used, the vulnerability could lead to unintended code execution. The vulnerability has a high severity score of 8.8. Users are advised to upgrade to version 1.29.0 where this issue is fixed.
DBI versions before 1.653 for Perl load arbitrary modules via unvalidated dbm_type and dbm_mldbm attributes in DBD::DBM.
DBD::DBM passes the dbm_type and dbm_mldbm connect attributes to require without checking that the value names a module. require treats a path-shaped string as a literal filename and does not consult @INC, so the attribute chooses the file that Perl loads and runs.
The MLDBM::Serializer:: prefix that DBD::DBM prepends to dbm_mldbm is not a boundary: only the :: separators are rewritten to /, so a value containing / traverses out of the serializer directory. The value is also assigned to $MLDBM::Serializer, which MLDBM requires the same way when it ties the table.
A caller that lets an untrusted party influence either attribute, for example through a DSN fragment or a parameter that selects a storage backend, runs the file-scope code of whatever module the value names.
For example,
my $dsn = "dbi:DBM:f_dir=/var/db;dbm_type=../../Untrusted.pm"
my $dbh = DBI->connect( $dsn );
Note that DBD::Gofer forwards connect attributes to the server side, and DBI::ProxyServer checks only that a DSN starts with a driver prefix.
Mongoid contains an unsafe reflection weakness in the query path used for embedded documents. An application that passes an externally supplied field name to certain in-memory query methods may allow an unauthenticated party to obtain unintended disclosure of stored document data and to permanently remove stored records.
Mongoid contains an unsafe reflection weakness in the document persistence layer of its object-document mapping code. Input whose keys are passed through from an unauthenticated party by an embedding application can cause unintended internal method invocation instead of the intended array field update. This may result in unintended removal of stored records and in the embedding application becoming unresponsive.
IBM MQ could allow an authenticated attacker with cluster access to cause a denial of service or potentially execute arbitrary code due to improper validation of cluster command message lengths.
Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Protection mechanism bypass.
CVE-2026-61599 is a high-severity vulnerability in djust versions prior to 1.0.7 that allows unauthenticated WebSocket clients to cause the server to import and execute arbitrary Python modules. This occurs because the live transport resolves LiveView classes from client-supplied module paths using __import__ before validating the class or performing authentication. The default allowlist for permitted modules is fail-open and uses loose matching, enabling unsafe reflection and code execution. Version 1.0.7 introduces a fail-closed check that restricts imports to already loaded modules or explicitly allowed modules, preventing this unsafe behavior.
CVE-2026-76825 is a vulnerability in zopefoundation's RestrictedPython prior to version 8.4 that allows sandbox escape. The issue arises when restricted code can access the standard library string module's Formatter class or instances, which internally perform attribute and item traversal without RestrictedPython's safer_getattr protections. This enables restricted code to reach sensitive objects such as function globals, builtins, file access, or code execution primitives, compromising confidentiality, integrity, and availability. The vulnerability is fixed in version 8.4.
Apache Airflow Apache Kafka provider versions 1.15.0 up to but not including 2.0.0 contain a vulnerability where externally controlled input in a Kafka connection's extra field is unsafely reflected and executed. This allows users with permission to edit Airflow connections to achieve arbitrary code execution in the scheduler process if Kafka event producers are enabled. The vulnerability is mitigated in version 2.0.0 and later by introducing an allowlist for connection-string callbacks. Deployments using Google Managed Kafka are not affected.
OpenAM versions prior to 16.1.2 contain a critical code injection vulnerability in the pre-authentication /authservice PLL endpoint. This endpoint accepts a CustomCallback XML element with a className parameter that allows loading and instantiating arbitrary Java classes without verifying interface implementation. The default configuration exposes this endpoint without authentication, enabling attackers to execute arbitrary code on the server. The vulnerability is fixed in version 16.1.2.
CVE-2026-79987 is a high-severity vulnerability in Craft CMS that allows a remote, authenticated user with only the accessCp permission (non-admin) to execute operating system commands as the PHP web worker. This issue arises from unsafe reflection due to externally controlled input used to select classes or code. The vulnerability affects Craft CMS versions from 5.8.0 up to but not including 5.10.13.