vm2 is an open source vm/sandbox for Node.js. From 3.9.6 to 3.10.5, vm2's bridge exposes mutable proxies for real host-realm intrinsic prototypes and then forwards sandbox writes into the underlying host objects with otherReflectSet() and otherReflectDefineProperty(), which lets attacker-controlled JavaScript running in a default VM or inherited NodeVM mutate shared host Object.prototype, Array.prototype, and Function.prototype from inside the sandbox This vulnerability is fixed in 3.11.0.
vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, It is possible to reach BaseHandler.getPrototypeOf, which can be used to get arbitrary prototypes. This vulnerability is fixed in 3.11.0.
vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, it is possible to obtain the host Object. There are various ways to use the host Object, to escape the sandbox, one example would be using HostObject.getOwnPropertySymbols to obtain Symbol(nodejs.util.inspect.custom). This vulnerability is fixed in 3.11.0.
CVE-2026-44295 is a high-severity vulnerability in protobufjs-cli, the command line add-on for protobuf.js. Before versions 1.2.1 and 2.0.2, the static code generation feature (pbjs) could produce unsafe JavaScript identifiers derived from schema-controlled names without proper sanitization. This flaw allows crafted schemas or JSON descriptors to inject unsafe code into the generated JavaScript output. The vulnerability is classified as CWE-94 (Improper Control of Generation of Code). It has a CVSS v3.
protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs generated JavaScript for toObject conversion could include an unsafe expression derived from a schema-controlled bytes field default value. A crafted descriptor with a non-string default value for a bytes field could cause attacker-controlled code to be emitted into the generated conversion function. This vulnerability is fixed in 7.5.6 and 8.0.2.
protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs used plain objects with inherited prototypes for internal type lookup tables used by generated encode and decode functions. If Object.prototype had already been polluted, those lookup tables could resolve attacker-controlled inherited properties as valid protobuf type information. This could cause attacker-controlled strings to be emitted into generated JavaScript code. This vulnerability is fixed in 7.5.6 and 8.0.2.
ChurchCRM is an open-source church management system. Prior to 7.3.2, The fix for CVE-2026-39337 is incomplete. The pre-authentication remote code execution vulnerability in ChurchCRM's setup wizard via unsanitized DB_PASSWORD remains fully exploitable This vulnerability is fixed in 7.3.2.
The The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 0.9.2.3. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
CVE-2026-44262 is a critical code injection vulnerability in dedoc's scramble tool versions 0.13.2 up to but not including 0.13.22. The vulnerability arises when documentation endpoints are publicly accessible and validation rules incorporate user-controlled input, enabling arbitrary PHP code execution during API documentation generation. This flaw has a high CVSS score of 9.4, indicating severe confidentiality and integrity impacts. The issue is fixed starting from version 0.13.22.
CVE-2026-43892 is a high-severity cross-site scripting (XSS) vulnerability in AntSword, a cross-platform website management toolkit. Versions prior to 2.1.16 have incomplete input sanitization in the noxss() function, which allows injection of malicious code via jquery.terminal format code, leading to a one-click remote code execution (RCE). This vulnerability is fixed in version 2.1.16. There are no known exploits in the wild at this time.
Improper control of generation of code ('code injection') in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to execute code over a network.
CVE-2026-40129 is a code injection vulnerability in SAP Application Server ABAP for SAP NetWeaver and ABAP Platform. An authenticated attacker can send specially crafted inputs that, when processed, may execute arbitrary code for other users subscribed to the affected channel. The vulnerability impacts the integrity of the system but does not affect confidentiality or availability. The CVSS score is 4.3, indicating a medium severity level. There is no confirmed patch or official remediation available at this time, and no known exploits have been reported in the wild.
The Adversarial Robustness Toolbox (ART) thru 1.20.1 contains a command-line argument injection vulnerability in its Kubeflow component (robustness_evaluation_fgsm_pytorch.py). The script uses the unsafe eval() function to parse string values provided via the --clip_values and --input_shape command-line arguments. This allows an attacker to inject arbitrary Python code into these arguments, which will be executed when eval() is called. The vulnerability can be exploited remotely if an attacker can control these arguments (e.g., through pipeline configuration or automated scripts), leading to arbitrary code execution on the system running the ART evaluation.
The Adversarial Robustness Toolbox (ART) thru 1.20.1 contains a remote code execution vulnerability in its Kubeflow component. The robustness evaluation function for PyTorch models uses the unsafe eval() function to dynamically evaluate user-supplied strings for the LossFn and Optimizer parameters without any sanitization or security restrictions. An attacker can exploit this by providing a specially crafted string that contains arbitrary Python code, which will be executed when eval() is called, leading to complete compromise of the system running the ART evaluation.
CVE-2026-43874 is a high-severity code injection vulnerability in WWBN AVideo versions up to and including 29.0. The issue arises because the server-side mitigation for a previous vulnerability (CVE-2026-40911) only strips malicious payloads in a specific JSON field ($json['msg']), but the relay function uses a different field ($msg['json']) to select outbound messages. An unauthenticated attacker can obtain a WebSocket token, connect to the WebSocket server, and send a specially crafted message that bypasses the stripping mechanism. This message is then relayed verbatim to logged-in users and executed via eval() on the client side, enabling code injection. There is a commit referenced that contains an updated fix, but no official patch or vendor advisory is provided in the data.
OWASP BLT is a QA testing and vulnerability disclosure platform that encompasses websites, apps, git repositories, and more. Prior to 2.1.2, .github/workflows/pre-commit-fix.yaml uses pull_request_target (privileged trigger) but checks out and executes code directly from the attacker's fork, enabling RCE with write permissions. This vulnerability is fixed in 2.1.2.
CVE-2026-42607 is a critical code injection vulnerability in the Grav file-based web platform. It affects versions prior to 2.0.0-beta.2. An authenticated administrator can exploit this flaw by uploading a crafted ZIP file through the Direct Install tool, bypassing protections against direct PHP uploads. This allows execution of arbitrary PHP code or installation of a persistent web shell, leading to remote code execution. The vulnerability is fixed in version 2.0.0-beta.2.
CVE-2026-6433 is a high-severity vulnerability in the Custom css-js-php WordPress plugin version 2.0.7. It arises from improper sanitization of user input before it is used in a SQL query, with the query result subsequently passed to eval(), enabling unauthenticated users to execute arbitrary PHP code on the server. This vulnerability can lead to code injection, potentially compromising the affected system's confidentiality, integrity, and availability.
pyp2spec generates working Fedora RPM spec file for Python projects. Prior to version 0.14.1, pyp2spec was writing PyPI package metadata (e.g.the summary field) into the generated spec file without escaping RPM macro directives. When a packager then runs rpmbuild, those directives get evaluated, so a malicious package can execute arbitrary commands on the build machine. This issue has been patched in version 0.14.1.