CWE-94: Code Injection vulnerabilities

OpenZeppelin Contracts Wizard is a web application to interactively build a contract out of components from OpenZeppelin Contracts. Versions prior to 0.10.9 generate a Hardhat test file (`test/test.ts`) by interpolating user-supplied `opts.name` (ERC20/ERC721) and `opts.uri` (ERC1155) directly into TypeScript string literals at `zip-hardhat.ts:48` and `:50` without any JavaScript string escaping. No authentication is required: an attacker crafts a URL such as `https[:]//wizard[.]openzeppelin[.]com/#/erc20?name=");require("child_process").execSync("...");("` and shares it with a developer. When the victim downloads the resulting zip archive and runs `npx hardhat test`, the injected Node.js code executes with the developer's local OS privileges. Version 0.10.9 fixes the issue.

CVE-2026-66709 is a critical vulnerability in WebAppick CTX Feed versions up to and including 6.6.42 that allows a shop manager to perform remote code execution (RCE) due to improper control of code generation (CWE-94). This vulnerability enables an attacker with high privileges to execute arbitrary code remotely without user interaction.

CVE-2026-65553 is a critical vulnerability in the Spider Analyser WordPress plugin (versions up to 2.1.3) that allows unauthenticated remote code execution due to improper control of code generation (CWE-94). This vulnerability has a CVSS score of 10, indicating it is highly severe with network attack vector, no privileges or user interaction required, and complete impact on confidentiality, integrity, and availability.

CVE-2026-65548 is a critical remote code execution vulnerability in Muffingroup Betheme versions up to and including 28.4.2. It involves improper control of code generation (CWE-94), allowing a contributor-level user to execute arbitrary code remotely without user interaction. The vulnerability has a very high CVSS score of 9.9, indicating severe impact on confidentiality, integrity, and availability.

CVE-2026-67531 is a critical remote code execution vulnerability in the agentfront frontmcp framework prior to version 1.5.7. It arises from improper control of code generation due to exposure of live host Zod schema instances in sandboxed scripts. This allows an attacker to escape the sandbox and execute arbitrary code with the server user's privileges, potentially exposing sensitive secrets and credentials. The vulnerability is fixed in version 1.5.7.

A critical code injection vulnerability (CWE-94) exists in Nuxt DevTools versions prior to 3.3.1. The devtools expose an unauthenticated bidirectional RPC channel over the Vite HMR WebSocket, allowing any client with network access to the HMR endpoint to invoke certain RPC methods without authentication. Specifically, the updateOptions() and openInEditor() methods lack proper authentication checks, enabling an attacker to set arbitrary commands and execute them on the developer's machine. This vulnerability is fixed in version 3.3.1.

PraisonAI versions 3.9.26 through 4.6.57 and praisonaiagents versions 0.12.12 through 1.6.57 contain a code injection vulnerability in the workflow "include" feature. The vulnerability arises because the _execute_include() function imports and executes an included recipe's tools.py file without enforcing security gates or using a safe loader. This allows arbitrary Python code execution if an attacker can cause a workflow to include an untrusted local recipe. The issue is fixed in versions 4.6.58 and 1.6.58 respectively.

IBM Langflow OSS 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, and 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitrary code due to improper validation of module imports.

IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitrary code due to code injection.

IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitrary code due to improper validation of Python code during AST-based security scanning.

IBM Langflow OSS 1.0.0 through 1.10.3 could allow an authenticated attacker to execute unintended code during Agentic Assistant validation due to improper handling of LLM‑generated components. The application executes model‑generated Python code in the backend during validation prior to user approval, which may allow an attacker to trigger side effects such as outbound network access, file system interaction, or data exfiltration with the privileges of the Langflow backend process.

IBM Langflow OSS 1.0.0 through 1.10.3 installations allow anyone on the internet to execute arbitrary code on the server without any credentials via 2 HTTP requests.

IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote attacker to inject arbitrary code on the system, due to the improper control of user input code.

rust-iot-platform allows creating a "calc rule" via POST /calc-rule/create (api/src/controller/calc_rule_router.rs) containing an arbitrary field. This route does not take the AuthToken request guard used elsewhere in the application, making it reachable without authentication.

CVE-2026-46581 is a high severity path traversal vulnerability in Eclipse Mojarra version 2.3. The issue arises from improper URL handling in the DefaultFaceletFactory component, which fails to sanitize or block remote URLs. This flaw allows an attacker to specify a remote Facelet URL that the server includes and processes with its privileges, potentially exposing restricted files such as WEB-INF/web.xml or /etc/passwd.

Magistrala's Rules Engine allows authenticated users to create rules with embedded Go or Lua scripts executed server-side when IoT messages arrive. The Lua script engine (re/lua.go) performs no input validation at all and preloads dangerous libraries: db (arbitrary database access), ioutil (file I/O), an HTTP client (SSRF), and filepath (traversal).

MacCMS10's admin template editor (application/admin/controller/Template.php) blocks dangerous PHP functions in template content via a blacklist regex, but the blacklist omitted exec, passthru, popen, show_source, create_function, register_shutdown_function, register_tick_function, and error_log.

CVE-2026-70477 is a critical code injection vulnerability in FlowiseAI Flowise versions prior to 3.1.3. The flaw allows an attacker to send a crafted prompt to a chatflow using a CSV Agent node, causing the large language model to generate and execute malicious Python code in an unsandboxed Pyodide environment. This occurs because untrusted data is used to build the LLM prompt and the resulting code validation is bypassed. The vulnerability is fixed in version 3.1.3.

PDM, a Python package and dependency manager, versions up to and including 2.26.9 automatically load project-local plugins from a .pdm-plugins directory during initialization. This behavior allows an attacker-controlled file in an untrusted repository checkout to execute arbitrary Python code before any command is parsed. The vulnerability arises because the load_plugins() function runs during Core.init() and adds .pdm-plugins via site.addsitedir(), which processes .pth files and executes import lines immediately. This code execution occurs with the privileges of the user running pdm, affecting even benign commands like pdm --version. The issue is fixed in version 2.27.0.

Prior to 3.1.3, Flowise CSVAgent interpolates an attacker-controlled segment of the csvFile data URI directly into a Python source-code template that is then executed by Pyodide. Because Pyodide is loaded with the default js bridge to globalThis, which on Node.js exposes eval and dynamic import, the attacker can break out of the Python string literal, hand a JavaScript string to js.eval, dynamically import Node built-in modules such as fs and child_process, and execute arbitrary file I/O or OS commands as the Flowise process. The two validator paths around this code, validatePythonCodeForDataFrame and validateCustomReadCSVFunction, are never applied to the bootstrap template. A workspace user with chatflows:create or agentflows/chatflows update permission can plant a CSV Agent node with a crafted csvFile; once the chatflow is exposed via POST /api/v1/prediction/:id, any unauthenticated request triggers host remote code execution. This issue is fixed in version 3.1.3.