Inclusion of functionality from untrusted control sphere in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.
The Salty documentation repository builds and deploys the docs.saltbox.dev website. Prior to commit 649c9aea2daef1168eeb0415b44e65dbbde9f220, .github/workflows/trigger-pr-build.yml records an untrusted fork commit in the pr_info artifact, and the secret-bearing workflow_run job in .github/workflows/build-pr.yml checks out that commit before running pip install -r requirements.txt. A fork pull request can therefore supply attacker-authored setup.py or PEP 517 build hooks whose installation code executes in the privileged base-repository workflow with CF_API_TOKEN, GH_TOKEN, MKDOCS_GIT_COMMITTERS_APIKEY, and a write-capable GITHUB_TOKEN, allowing secret disclosure and follow-on compromise. The vulnerability is not caused by the repository-fork guard, and the demonstrated path requires attacker control of fork content rather than merely the artifact metadata. This vulnerability is fixed with commit 649c9aea2daef1168eeb0415b44e65dbbde9f220.
Aegisub is a cross-platform advanced subtitle editor. From 3.2.0 to 3.4.2, Aegisub automatically loads Automation scripts referenced by `Automation Scripts` metadata in `ASS` subtitle projects without asking whether the user trusts the scripts or their authors. An attacker can distribute a crafted `ASS` file together with a referenced malicious Automation script, and opening the `AS` file executes arbitrary code with the privileges of the Aegisub process. From 3.4.0 to 3.4.2, inconsistent handling of embedded `NUL` characters between extension validation and filesystem operations additionally allows a crafted `ASS/Lua` polyglot to reference and execute itself as a single-file variant. The vulnerability is fixed in Aegisub 3.5.0.
Dell Secure Connect Gateway (SCG) Policy Manager versions prior to 5.34.00.16 contain a vulnerability classified as Inclusion of Functionality from Untrusted Control Sphere (CWE-829). This flaw allows a low privileged remote attacker to potentially elevate privileges, access the filesystem, and execute code remotely. The vulnerability has a high severity with a CVSS score of 7.5. No patch or remediation information is provided in the available data.
CVE-2026-105331 is a local privilege escalation vulnerability in Checkmk versions 2.5.0 up to but not including 2.5.0p10. It arises from an untrusted search path issue in the 'mk-oracle' agent plugin that references the Oracle Instant Client. A user with access to modify the Oracle Instant Client used by this plugin can escalate privileges if the plugin is enabled on the agent.
### Summary
`allow_external_plugins=False` (the default, and the CLI default) is meant to restrict docling to its own model plugins. However, docling's plugin factories call pluggy's `load_setuptools_entrypoints()`, which imports every module registered under docling's plugin entry-point group. Only afterwards does docling filter out modules outside the `docling.` namespace. Import-time code in any installed third-party plugin therefore runs even though external plugins are disabled.
### Details
In `docling/models/factories/base_factory.py`, `load_from_plugins()` loads all entry points first and applies the `allow_external_plugins` check only to the already-imported modules. The CLI creates these factories when it starts, so running `docling` imports every registered plugin module. A log message says the plugin "will not be loaded", although its module has already been imported.
### Affected configurations
Environments in which a package registering a docling plugin entry point is installed, for example an unvetted or compromised dependency, and which rely on `allow_external_plugins=False` to keep that code from running.
### Impact
Execution of a third-party plugin module's import-time code in the docling process, contrary to the documented behaviour of `allow_external_plugins=False`.
### Patches
Fixed in docling 2.131.0 by [#4413](https://github.com/docling-project/docling/pull/4413). Plugin entry points are now filtered by module name before they are loaded, so with `allow_external_plugins=False` third-party plugin modules are no longer imported.
### Workarounds
Upgrade to 2.131.0. For older versions:
Only install trusted packages in environments that run docling. Check which packages register docling plugin entry points with `importlib.metadata.entry_points()`.
CVE-2026-105677 is a path traversal vulnerability in TryGhost Ghost that allows an authenticated Administrator to execute arbitrary code on the server via a crafted theme. The issue affects Ghost versions from 6.10.3 up to but not including 6.64.0. The vulnerability is fixed in version 6.64.0. This flaw arises from improper limitation of pathname to a restricted directory when loading theme translation files.
auto-changelog versions before 2.6.1 merge configuration from inside the target repository, including untrusted files, into their options. This allows execution of attacker-controlled code via the handlebarsSetup option, loading malicious modules via plugins, git argument injection, arbitrary file writes, and outbound requests to attacker-chosen URLs. Version 2.6.1 mitigates this by treating in-repository configuration as untrusted and refusing to run if unsafe options are set unless overridden by a specific flag.
LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. A document could name a Java database driver for such a link to be loaded from a remote location, so opening the document could run Java code from that location. In fixed versions an entry in a Java class path has to be a file URL.
DigitalCanion SA has discovered a vulnerability that allows remote attackers to execute arbitrary code on affected installations of the product. Authentication may be required to exploit this vulnerability.
The specific flaw exists within the Configuration → Services → Music on Hold functionality of the web portal listening on TCP port 443. The application is intended to allow users to upload WAV audio files but fails to properly validate the uploaded file type. An attacker can exploit this behavior to upload a malicious shared object (.so) instead of a WAV file. When the uploaded file is subsequently processed by the affected component, attacker-controlled code is loaded and executed in the context of the affected process. This can result in remote code execution and potentially full compromise of the underlying Linux system.
DigitalCanion has discovered a vulnerability that allows an attacker to cause the system to load an attacker-controlled .so file instead of the expected legitimate module. The loading mechanism relies on a predictable module name without adequately verifying the file’s origin or integrity. A malicious shared object using the expected name can therefore be loaded by a privileged process. The module code then executes within the context and privileges of that process. This results in arbitrary code execution and full compromise of the Mitel Linux virtual machine.
ConvertX versions before 0.19.0 contain a critical vulnerability (CVE-2026-105080) where recipe files are not blocked and are passed directly to the Calibre ebook-convert program. This allows inclusion of functionality from untrusted control spheres via executable code in .recipe or .downloaded_recipe files.
CVE-2026-55251 is a code injection vulnerability in the netbox-community devicetype-library repository. The issue arises because the continuous integration (CI) workflow executed code from pull requests before any maintainer review, allowing an unprivileged contributor to run arbitrary code on the CI runner by modifying certain configuration files. This vulnerability has been patched by commit f41fc1e.
CVE-2026-100256 is a high-severity vulnerability in JetBrains IntelliJ IDEA before version 2026.2.3. It allows remote code execution (rCE) via Structural Search script constraints when working with untrusted projects. The vulnerability is identified as CWE-829, which relates to inclusion of functionality from untrusted control spheres. No official patch information is provided in the input data.
CVE-2026-86131 is a critical code injection vulnerability in WatchGuard Fireware OS affecting the BOVPN Over TLS client configuration. An attacker controlling the remote VPN server can exploit this flaw to execute arbitrary commands with root privileges on the connecting Firebox device. The vulnerability affects multiple versions of Fireware OS prior to fixed releases. A high-severity CVSS score of 9.2 reflects the potential impact of remote, unauthenticated exploitation without user interaction. Fixed versions have been released by WatchGuard.
Network UPS Tools is a collection of programs which provide a common interface for monitoring and administering UPS, PDU and SCD hardware. Prior to commits 658b24e and 1aa31d1, the GitHub Actions script used to prepare NUT tarballs and update GitHub Checks statuses and PR comments about it was mis-structured in terms of mixing code running with higher privileges (single-use token generated with write permissions) and untrusted inputs (PR source branch). A malicious PR run from a fork could extract the GITHUB_TOKEN value. It could potentially be abused while it was valid (while the GHA job ran) to manipulate Git repository contents, commit checks/statuses, or issue/PR comments, according to permissions it was issued with. This issue has been patched via commits 658b24e and 1aa31d1.
The file write tool in Amazon Kiro IDE versions before 1.0.242 might allow remote unauthenticated actors to inject crafted instructions into the agent's context. When a user runs the agent in a crafted repository as an untrusted workspace, sending any message can cause agent modifications to auto-loaded global configuration paths.
We recommend you upgrade to Kiro IDE version 1.0.242 or later. Users who ran the agent in an untrusted workspace on an earlier version should also review the global Kiro configuration directory (~/.kiro) for entries they did not create.