PDM, a Python package and dependency manager, versions up to and including 2.26.9 automatically load project-local plugins from a .pdm-plugins directory during initialization. This behavior allows an attacker-controlled file in an untrusted repository checkout to execute arbitrary Python code before any command is parsed. The vulnerability arises because the load_plugins() function runs during Core.init() and adds .pdm-plugins via site.addsitedir(), which processes .pth files and executes import lines immediately. This code execution occurs with the privileges of the user running pdm, affecting even benign commands like pdm --version. The issue is fixed in version 2.27.0.
Prior to 3.1.3, Flowise CSVAgent interpolates an attacker-controlled segment of the csvFile data URI directly into a Python source-code template that is then executed by Pyodide. Because Pyodide is loaded with the default js bridge to globalThis, which on Node.js exposes eval and dynamic import, the attacker can break out of the Python string literal, hand a JavaScript string to js.eval, dynamically import Node built-in modules such as fs and child_process, and execute arbitrary file I/O or OS commands as the Flowise process. The two validator paths around this code, validatePythonCodeForDataFrame and validateCustomReadCSVFunction, are never applied to the bootstrap template. A workspace user with chatflows:create or agentflows/chatflows update permission can plant a CSV Agent node with a crafted csvFile; once the chatflow is exposed via POST /api/v1/prediction/:id, any unauthenticated request triggers host remote code execution. This issue is fixed in version 3.1.3.
CVE-2026-69259 is a critical code injection vulnerability in FlowiseAI's Flowise prior to version 3.1.3. The SQLite Record Manager node improperly handles user-controlled configuration, allowing an authenticated attacker to overwrite the SQLite database path. Exploiting this, an attacker running the published Docker image as root could write malicious SQLite databases to sensitive system paths such as /etc/chromium/exploit.conf. By controlling database content, the attacker could inject shell syntax that executes when Puppeteer launches Chromium and sources configuration files. This vulnerability is fixed in Flowise version 3.1.3.
CVE-2026-58074 is a high-severity code injection vulnerability in Veeam ONE that allows a high-privileged user to execute arbitrary code on the server. The vulnerability is identified as CWE-94 and has a CVSS 4.0 base score of 8.6, indicating significant impact if exploited. No patch or official remediation guidance is currently provided by the vendor. There are no known exploits in the wild at this time.
CVE-2026-64633 is a critical remote code injection vulnerability in Veeam ONE that allows unauthenticated attackers to execute arbitrary code on the agent host. It has a CVSS 4.0 base score of 10. No patch or official remediation guidance is currently provided by the vendor. The vulnerability is classified under CWE-94 (Code Injection).
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the CSVAgent node allowed users to provide Python code that is executed through pyodide; although a denylist blocked dangerous Python constructs, pandas.read_pickle() could deserialize a pickled payload and achieve code execution without matching the denied words. The affected file is flowise-components/nodes/agents/CSVAgent/CSVAgent.ts, where user-supplied customReadCSVFunc is evaluated as pd.${customReadCSVFunc}. An authenticated user who can create or modify a chatflow can add a CSV Agent, place a malicious read_pickle payload in the Additional Parameters, save the chatflow, and trigger /api/v1/prediction/<UUID> to execute commands. This issue is fixed in version 3.1.3.
CVE-2026-69255 is a critical code injection vulnerability in Flowise versions prior to 3.1.3. It arises from improper handling of attacker-controlled CSV data in the CSVAgent component, where unvalidated input is interpolated directly into executable Python code. This flaw allows an authenticated attacker to execute arbitrary operating system commands with root privileges in the Flowise container. The issue is fixed in version 3.1.3.
CVE-2026-69254 is a critical code injection vulnerability in FlowiseAI's Flowise prior to version 3.1.3. It allows an authenticated attacker with limited privileges to execute arbitrary system commands as root by exploiting improper control over JavaScript code execution options. The flaw arises from the executeJavaScriptCode() function merging caller-provided NodeVM options over default security settings, enabling escalation to full system command execution. This issue is fixed in Flowise version 3.1.3.
Flowise versions prior to 3.1.3 contain a code injection vulnerability in record manager and agent memory nodes. Authenticated users can set arbitrary TypeORM DataSource options via the additionalConfig input, enabling them to load local JavaScript files and execute arbitrary code on the server. This vulnerability is fixed in version 3.1.3.
CVE-2026-16623 is a high-severity code injection vulnerability in the Create Block WordPress plugin before version 2.10.0. It allows a multisite subsite administrator, who has certain capabilities but is normally restricted from editing PHP files, to inject and execute arbitrary PHP code on the server. This occurs because user-supplied text is not properly escaped before being written into a generated PHP pattern file.
CVE-2026-16881 is a code injection vulnerability in the LINE Android app prior to version 26.7.2. The flaw exists in the profile rendering component, which does not properly validate or sandbox script content embedded in profile templates. This allows an attacker who can place crafted content in a profile to execute unintended code with the app's privileges when a victim views that profile. A server-side mitigation has been deployed that protects even unpatched Android clients.
Improper control of generation of code ('code injection') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
CVE-2026-18667 is a critical vulnerability in Tenable Sensor Proxy that allows remote code execution with elevated privileges. The attack requires an operator to connect the sensor to a host controlled by an attacker, which then enables the attacker to execute arbitrary code. The vulnerability is classified under CWE-94 (Improper Control of Generation of Code). No patch or official remediation information is currently available.
Ouroboros is a local-first runtime for AI coding agents that records their actions and applies user-defined policies to constrain behavior. Versions prior to 0.42.1 have an incomplete denylist. Several execution-routing keys of the same RCE class were omitted, so a malicious cloned repo can still reach arbitrary command execution by shipping a .env (auto-loaded at import, with no review step). The CVE-2026-47211 fix added _UNTRUSTED_ENV_DENYLIST to stop an untrusted project-directory .env from redirecting execution, but it did not account for all keys. The backend config-home and MCP/plugin roots bypass the approval gate by pointing the nested agent, MCP servers, and plugin roster at attacker config. Other variables re-enable blocked local transports, replace sub-agent prompts, switch backends, and lower tool approval classes, further weakening the approval gate. This issue has been fixed in version 0.42.1.
The Kali Forms — Contact Form & Drag-and-Drop Builder plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.4.20 via the _save_data function. This is due to insufficient validation of the 'thisPermalink' field value before it overwrites a trusted callable placeholder, allowing attacker-controlled strings to reach call_user_func() in _save_data(). This makes it possible for unauthenticated attackers to execute code on the server. Exploitation requires the target form to define a field with a name matching one of the reserved placeholder keys ('thisPermalink', 'entryCounter', or 'submission_link'), as check_if_placeholders_changed() only processes POST keys present in the form's field_type_map.
Savon is a Ruby SOAP client. From 0.9.8 until 2.17.2, Savon::Model .all_operations interpolates attacker-controlled WSDL operation names into Ruby source passed to module_eval, allowing Ruby code execution in the application process. This issue is fixed in version 2.17.2.
Improper Control of Generation of Code ('Code Injection') vulnerability in Innotim Software, Telecommunications and Consulting Trade Ltd. Co. Logsign SIEM allows Code Injection.
This issue affects Logsign SIEM: before 6.4.115.
ElementsKit Elementor Addons WordPress plugin versions before 3.10.01 contain a code injection vulnerability. This flaw allows a user with administrative capabilities to save a custom-widget definition that is written verbatim into a PHP file and executed by the plugin, enabling arbitrary PHP code execution on the server. In multisite networks, this can allow a non-super subsite Administrator to escalate privileges to host-level code execution beyond their granted permissions.
IBM Langflow OSS versions 1.0.0 through 1.10.0 contain a critical vulnerability that allows remote attackers to inject arbitrary code due to improper control of user input code. This vulnerability is identified as CWE-94, indicating code injection issues. The flaw can lead to complete compromise of confidentiality, integrity, and availability of the affected system.