SandboxJS is a JavaScript sandboxing library. Prior to 0.8.27, SanboxJS does not properly restrict __lookupGetter__ which can be used to obtain prototypes, which can be used for escaping the sandbox / remote code execution. This vulnerability is fixed in 0.8.27.
Orval generates type-safe JS clients (TypeScript) from any valid OpenAPI v3 or Swagger v2 specification. Versions starting with 7.19.0 and prior to 7.21.0 and 8.2.0 have an incomplete fix for CVE-2026-23947. While the jsStringEscape function properly handles single quotes ('), double quotes (") and so on, it is still possible to achieve code injection using only a limited set of characters that are currently not escaped. The vulnerability lies in the fact that the application can be forced to execute arbitrary JavaScript using characters such as []()!+. By using a technique known as JSFuck, an attacker can bypass the current sanitization logic and run arbitrary code without needing any alphanumeric characters or quotes. Version 7.21.0 and 8.2.0 contain an updated fix.
Salt's junos execution module contained an unsafe YAML decode/load usage. A specially crafted YAML payload processed by the junos module could lead to unintended code execution under the context of the Salt process.
CVE-2026-1340 is a critical vulnerability in Ivanti Endpoint Manager Mobile involving improper control of code generation, classified as CWE-94 (Code Injection). This flaw allows unauthenticated attackers to execute arbitrary code remotely. The vulnerability has a CVSS 3.1 base score of 9.8, indicating high impact on confidentiality, integrity, and availability. No patch or official remediation information is currently available. There are no known exploits in the wild at this time. The affected versions are unspecified, and the product is not a cloud service.
AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents that automate complex workflows. Prior to autogpt-platform-beta-v0.6.44, AutoGPT Platform's block execution endpoints (both main web API and external API) allow executing blocks by UUID without checking the `disabled` flag. Any authenticated user can execute the disabled `BlockInstallationBlock`, which writes arbitrary Python code to the server filesystem and executes it via `__import__()`, achieving Remote Code Execution. In default self-hosted deployments where Supabase signup is enabled, an attacker can self-register; if signup is disabled (e.g., hosted), the attacker needs an existing account.autogpt-platform-beta-v0.6.44 contains a fix.
CVE-2026-24897 is a critical path traversal vulnerability in Erugo, a self-hosted file-sharing platform, affecting versions prior to 0.2.15. An authenticated low-privileged user can exploit insufficient validation of user-supplied paths to upload arbitrary files anywhere on the server, including writable paths within the public web root. This enables remote code execution (RCE), allowing full compromise of the Erugo instance without requiring elevated privileges or user interaction. The vulnerability stems from improper limitation of pathname (CWE-22) and leads to code injection (CWE-94) and unrestricted file upload (CWE-434). Although no known exploits are reported in the wild yet, the CVSS 3.1 score is 10.0, reflecting the critical severity. Organizations using affected Erugo versions should upgrade to 0.
SandboxJS is a JavaScript sandboxing library. Versions prior to 0.8.26 have a sandbox escape vulnerability due to `AsyncFunction` not being isolated in `SandboxFunction`. The library attempts to sandbox code execution by replacing the global `Function` constructor with a safe, sandboxed version (`SandboxFunction`). This is handled in `utils.ts` by mapping `Function` to `sandboxFunction` within a map used for lookups. However, before version 0.8.26, the library did not include mappings for `AsyncFunction`, `GeneratorFunction`, and `AsyncGeneratorFunction`. These constructors are not global properties but can be accessed via the `.constructor` property of an instance (e.g., `(async () => {}).constructor`). In `executor.ts`, property access is handled. When code running inside the sandbox accesses `.constructor` on an async function (which the sandbox allows creating), the `executor` retrieves the property value. Since `AsyncFunction` was not in the safe-replacement map, the `executor` returns the actual native host `AsyncFunction` constructor. Constructors for functions in JavaScript (like `Function`, `AsyncFunction`) create functions that execute in the global scope. By obtaining the host `AsyncFunction` constructor, an attacker can create a new async function that executes entirely outside the sandbox context, bypassing all restrictions and gaining full access to the host environment (Remote Code Execution). Version 0.8.26 patches this vulnerability.
Improper Control of Generation of Code ('Code Injection') vulnerability in pilgrimage233 Minecraft-Rcon-Manage.This issue affects Minecraft-Rcon-Manage: before 3.0.
Improper Control of Generation of Code ('Code Injection') vulnerability in liuyueyi quick-media (plugins/svg-plugin/batik-codec-fix/src/main/java/org/apache/batik/ext/awt/image/codec/png modules). This vulnerability is associated with program files PNGImageEncoder.Java.
This issue affects quick-media: before v1.0.
vm2 is an open source vm/sandbox for Node.js. In vm2 prior to version 3.10.2, `Promise.prototype.then` `Promise.prototype.catch` callback sanitization can be bypassed. This allows attackers to escape the sandbox and run arbitrary code. In lib/setup-sandbox.js, the callback function of `localPromise.prototype.then` is sanitized, but `globalPromise.prototype.then` is not sanitized. The return value of async functions is `globalPromise` object. Version 3.10.2 fixes the issue.
Dioxus Components is a shadcn-style component library for the Dioxus app framework. Prior to commit 41e4242ecb1062d04ae42a5215363c1d9fd4e23a, `use_animated_open` formats a string for `eval` with an `id` that can be user supplied. Commit 41e4242ecb1062d04ae42a5215363c1d9fd4e23a patches the issue.
CVE-2026-0761 is a critical remote code execution vulnerability in Foundation Agents MetaGPT version 0.8.1. It stems from improper validation of user-supplied input in the actionoutput_str_to_mapping function, allowing unauthenticated attackers to execute arbitrary Python code. Exploitation requires no authentication or user interaction and can compromise confidentiality, integrity, and availability of affected systems. The vulnerability has a CVSS score of 9.8, indicating critical severity. Although no known exploits are currently in the wild, the flaw poses a significant risk to organizations running this software. European organizations using MetaGPT should prioritize patching or mitigating this issue. Countries with higher adoption of AI and automation tools, such as Germany, France, and the UK, are more likely to be impacted.
Red Hat OpenShift AI 3.2 has been released with updates addressing security issues identified by CVE-2025-62593 and CVE-2025-66418. The advisory notes the availability of updated images and provides guidance for upgrading clusters to apply the errata update. No specific fixes or technical details about the vulnerabilities are disclosed in the advisory. The vulnerabilities are associated with CWE-94 (Improper Control of Generation of Code), CWE-770 (Allocation of Resources Without Limits or Throttling), and CWE-352 (Cross-Site Request Forgery).
vLLM is an inference and serving engine for large language models (LLMs). Starting in version 0.10.1 and prior to version 0.14.0, vLLM loads Hugging Face `auto_map` dynamic modules during model resolution without gating on `trust_remote_code`, allowing attacker-controlled Python code in a model repo/path to execute at server startup. An attacker who can influence the model repo/path (local directory or remote Hugging Face repo) can achieve arbitrary code execution on the vLLM host during model load. This happens before any request handling and does not require API access. Version 0.14.0 fixes the issue.
5ire is a cross-platform desktop artificial intelligence assistant and model context protocol client. Prior to version 0.15.3, an unsafe option parsing vulnerability in the ECharts Markdown plugin allows any user able to submit ECharts code blocks to execute arbitrary JavaScript code in the renderer context. This can lead to Remote Code Execution (RCE) in environments where privileged APIs (such as Electron’s electron.mcp) are exposed, resulting in full compromise of the host system. Version 0.15.3 patches the issue.
CVE-2025-33233 is a high-severity code injection vulnerability in NVIDIA Merlin Transformers4Rec affecting all versions prior to commit 27ddd49. It allows an attacker with local privileges and low complexity to execute arbitrary code without user interaction, potentially leading to privilege escalation, information disclosure, and data tampering. The vulnerability arises from improper control over code generation (CWE-94). Although no known exploits are currently in the wild, the impact on confidentiality, integrity, and availability is high. European organizations using Merlin Transformers4Rec in AI/ML recommendation systems should prioritize patching or mitigating this flaw. Countries with significant AI technology adoption and NVIDIA product usage, such as Germany, France, and the UK, are most at risk. Mitigation involves applying the fixed commit, restricting local access, and auditing code inputs. Given the CVSS 7.8 score, the threat is classified as high severity.
CVE-2026-23852 is a medium severity stored Cross-Site Scripting (XSS) vulnerability in SiYuan Note versions prior to 3.5.4. It allows attackers to inject arbitrary HTML attributes into the 'icon' attribute of a block via the /api/attr/setBlockAttrs API. The injected payload is rendered unsanitized in the dynamic icon feature, leading to stored XSS and, in the desktop environment, potential remote code execution (RCE). This vulnerability bypasses a previous fix and affects personal knowledge management systems using vulnerable SiYuan versions. No known exploits are currently reported in the wild. The vulnerability has a CVSS 4.0 score of 5.8, indicating medium severity.
LobeChat is an open source chat application platform. Prior to version 2.0.0-next.180, a stored Cross-Site Scripting (XSS) vulnerability in the Mermaid artifact renderer allows attackers to execute arbitrary JavaScript within the application context. This XSS can be escalated to Remote Code Execution (RCE) by leveraging the exposed `electronAPI` IPC bridge, allowing attackers to run arbitrary system commands on the victim's machine. Version 2.0.0-next.180 patches the issue.
CVE-2026-23742 is a high-severity code injection vulnerability in Zalando's Skipper HTTP router and reverse proxy versions prior to 0.23.0. The vulnerability arises from the default configuration allowing inline Lua scripts (-lua-sources=inline,file), which can be exploited if untrusted users can create Lua filters, for example via Kubernetes Ingress resources. Exploitation enables attackers with limited privileges to execute arbitrary Lua code, potentially reading the filesystem accessible to the Skipper process, including sensitive logs and secrets. This can lead to full compromise of confidentiality, integrity, and availability of the affected system. The vulnerability requires at least low privileges (PR:L) but no user interaction and can be exploited remotely over the network. The issue is fixed in version 0.23.0.
