CWE-829: Untrusted Functionality Inclusion vulnerabilities

In JetBrains IntelliJ IDEA before 2026.3 code execution in untrusted projects via a configured ShellCheck path

In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4, 2026.1.5.1, 2025.3.6.2 code execution was possible in untrusted projects via script engine discovery

In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 code execution was possible in untrusted projects via the Terraform tool path setting

In JetBrains CLion before 2026.3, 2026.2.4.1 code execution was possible in Safe Mode via a crafted GDB server debug profile

Altair is a GraphQL client for all platforms. From 7.2.4 until 8.5.8, packages/altair-iframe-sandbox/src/main.ts reads plugin_sandbox_opts from the iframe-sandbox query string and passes attacker-controlled scriptUrls to injectScript() in packages/altair-core/src/utils/inject.ts, which creates script elements in the page. The intended parent iframe flow places the page in an iframe with sandbox allow-scripts and without allow-same-origin, but direct navigation to a crafted iframe-sandbox URL omits that isolation and executes the supplied script in the origin serving Altair. Exploitation requires a victim to open the crafted URL, and the resulting script can access script-readable storage and make same-origin requests according to the deployment's authentication and cookie controls. This issue is fixed in version 8.5.8.

Black is the uncompromising Python code formatter. Prior to 26.10.1, the Black GitHub Action with use_pyproject: true accepts tool.black.required-version from pyproject.toml without validating that it is a released Black version specifier. An attacker who can submit a pull request can change that field to a direct reference to attacker-controlled code, causing the workflow to install and execute the code in the victim repository's GitHub Actions context. This issue is fixed in version 26.10.1.

IRISPowerscan versions up to 12.3 have a vulnerability where the application insufficiently restricts the use of untrusted scripts. Authenticated users with script access can import or modify scripts that the application executes, potentially leading to arbitrary code execution under the Windows user context running IRISPowerscan. The vulnerability is tracked as CVE-2026-95649 with a medium severity rating.

CVE-2026-63184 affects the christianhelle refitter tool, a C# REST API client generator using the Refit library. Versions prior to 2.1.1 invoke NJsonSchema with unsafe defaults for $ref resolution, allowing attacker-controlled OpenAPI descriptions to cause remote HTTP(S) requests and inline untrusted schema content. This leads to server-side request forgery, remote file inclusion, and local file inclusion vulnerabilities, permitting arbitrary local file disclosure. The issue does not lead to code execution due to runtime URL setting and string escaping. The vulnerability is fixed in version 2.1.1.

CVE-2026-118762 is a critical vulnerability in the Monkeytype repository's CI workflow prior to version 26.43.0. The workflow runs on pull_request_target with repository write permissions and executes code from forked pull requests with elevated privileges. This allows an external contributor whose pull request is labeled for formatting to run arbitrary code, access the GITHUB_TOKEN, and push changes or modify pull requests and issues. The vulnerability affects only the repository's CI workflow and not the Monkeytype application or user data. The issue is fixed in version 26.43.0.

CVE-2026-59176 affects the functype TypeScript functional programming libraries prior to version 1.4.4. The vulnerability allows an attacker to supply an unconstrained version string to the set_functype_version MCP tool, leading to arbitrary package installation and dynamic code execution within the MCP server process. This can be exploited by any MCP client invoking the tool, which is enabled by default without authentication in stdio mode. In certain deployments, remote network attackers can exploit this without local access. The flaw is fixed in version 1.4.4.

CVE-2026-59172 affects Joker, a Clojure interpreter and linter written in Go. Versions prior to 1.8.2 execute project-local linter customization files found by walking upward from the linted file, which can run untrusted code with the user's privileges. This behavior can be triggered when linting files inside untrusted repositories, including through editor integrations or CI jobs. The issue is fixed in version 1.8.2 by restricting executable customizations to the user's home directory only.

NVIDIA TensorRT-LLM for any platform contains a vulnerability in KvCacheAwareRouter tokenizer loading, where an attacker could cause inclusion of functionality from an untrusted control sphere. A successful exploit might lead to code execution, information disclosure, data tampering, and denial of service.

CVE-2026-54532 affects CloudPirates Open Source Helm Charts, where a pull_request_target GitHub Actions workflow was vulnerable to cache poisoning and OIDC token theft prior to a specific commit. The workflow checked out forked code using untrusted references, allowing attacker-controlled code to access repository secrets and tokens. Additionally, the workflow wrote to a shared Actions cache, which could be poisoned and later executed during release or publish workflows. This vulnerability has been patched in commit 271d415.

CVE-2026-114727 is a vulnerability in Roundcube Webmail versions before 1.6.20 and 1.7.x before 1.7.5. It involves unsafe handling of SVG and EPS image formats during contact photo uploads, which are processed by ImageMagick. These formats can reference external resources and invoke ImageMagick delegates, potentially allowing execution of untrusted functionality. The issue was fixed by removing SVG and EPS from accepted image types in versions 1.6.20 and 1.7.5.

CVE-2026-113461 is a local privilege escalation vulnerability in Checkmk version 2.5.0p14. It affects systems where a local user has write access to the Oracle client library directory of an Oracle home listed in the 'oratab' file or to the 'oratab' file itself. If the Checkmk agent has the 'mk-oracle' plugin enabled, an attacker can execute code with root privileges.

CVE-2026-113709 is a critical vulnerability in Argo CD, a GitOps continuous delivery tool for Kubernetes. It affects versions from 2.1.0 up to but not including 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2. When the --enable-helm option is enabled, Helm's config and data directories can be pointed to a repository-controlled location, allowing automatic loading and execution of a downloader plugin. This plugin runs with the repo-server user's privileges and can access repository credentials and other sensitive data. An attacker with Application get permission can exploit this by committing malicious Kustomization and plugin files to a Git repository or uploading them via the API. The issue is fixed in the specified versions.

Ivanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache configuration data, leading to privilege escalation to root, as exploited in the wild in October 2026.

CVE-2026-111091 is a high-severity vulnerability in JetBrains Junie CLI versions before 26.8.3. It allows code execution through an untrusted project's MCP server configuration. The vulnerability is identified as CWE-829, which involves inclusion of untrusted code. The CVSS 3.1 base score is 7.8, indicating significant impact on confidentiality, integrity, and availability. No known exploits are reported in the wild. The issue is fixed in version 26.8.3.

The plugin install flow in Claude Code and Claude Desktop checked out a marketplace's pinned commit SHA using `git checkout` without verifying that the resulting HEAD matched the pinned SHA. An attacker controlling a plugin's upstream repository could create a branch named identically to the pinned 40-character SHA, causing the checkout to silently resolve to the attacker's branch tip instead of the reviewed commit, resulting in attacker-controlled code being installed bypassing the pinned hash. Exploitation required a user to install a malicious plugin, pin to a safe hash, and for the plugin source to be hosted on a git host that permitted SHA-shaped branch names. Users on standard Claude Code auto-update have received this fix already. Users performing manual updates are advised to update to the latest version. Thank you to Or Nevo Michrowski of Air Security for reporting this issue.

Inclusion of functionality from untrusted control sphere in .NET allows an unauthorized attacker to execute code over a network.