CarrierWave is a framework to upload files from Ruby applications. In versions prior to 2.2.7 and 3.1.3, the content_type_denylist check fails to escape regex metacharacters in string entries, causing the denylist to silently not match the content types it is intended to block. In lib/carrierwave/uploader/content_type_denylist.rb:57, denylist entries are interpolated directly into a regex without Regexp.quote or anchoring, so an entry such as image/svg+xml becomes the pattern /image\/svg+xml/, in which + is treated as a quantifier rather than a literal character and therefore never matches the real MIME type image/svg+xml. This is inconsistent with the allowlist implementation, which correctly applies both Regexp.quote and a \A anchor. Other content types containing regex metacharacters, such as application/xhtml+xml, are affected as well. As a result, any application that relies on content_type_denylist to block image/svg+xml, most commonly to prevent stored XSS, is silently unprotected. An attacker can upload an SVG file containing arbitrary JavaScript; if the application serves that SVG inline from its own origin, the script executes in the victim's browser, resulting in stored XSS. This issue has been fixed in versions 2.2.7 and 3.1.3.
FastGPT is an AI Agent building platform. Prior to 4.15.0-beta1, the JavaScript sandbox worker at projects/code-sandbox/src/pool/worker.ts:356 blocks dynamic import() with the regex /\bimport\s*\(/.test(code). JavaScript syntax accepts a block comment between import and (; the regex matches only ASCII whitespace, and the bytes /, *, *, / are not in the \s character class. The payload import/**/("child_process") parses as a syntactically valid dynamic import that the regex does not detect. Because import() is not wrapped by the safeRequire Proxy (which only proxies require), the attacker loads child_process and calls execSync - arbitrary command execution as uid=100(sandbox) inside the sandbox container. This vulnerability is fixed in 4.15.0-beta1.
Zed code editor versions prior to 0.229.0 contain a vulnerability in the terminal tool permission system that allows bypass by prepending environment variable assignments to allowlisted commands. This can hijack program behavior, such as the PAGER environment variable, to execute arbitrary code. The issue is addressed in version 0.229.0. The vulnerability has a high severity score of 8.6 and impacts confidentiality, integrity, and availability. No known exploits in the wild have been reported.
Zed, a code editor, had a vulnerability in versions prior to 0.229.0 where its terminal tool permission system could be bypassed using bash variable expansion chaining (${var@P}). This allowed arbitrary command execution under an allowlisted command prefix. The issue is classified under CWE-184 (Incomplete List of Disallowed Inputs). The vulnerability has a CVSS score of 6.4, indicating medium severity. A fix for this vulnerability was introduced in version 0.229.0.
Tabby (formerly Terminus) is a highly configurable terminal emulator. Prior to 1.0.232, Tabby's terminal linkifier passes any detected URI directly to the operating system's protocol handler without validating the protocol scheme. This allows a malicious SSH or Telnet server to send crafted terminal output containing dangerous protocol URIs which Tabby renders as clickable links, triggering arbitrary OS protocol handlers on the victim's machine. This vulnerability is fixed in 1.0.232.
CVE-2026-43929 is a high-severity vulnerability in the felippe-regazio ssrfcheck library versions 1.3.0 and earlier. The library fails to block Server-Side Request Forgery (SSRF) attacks when private IP addresses are encoded as IPv4-mapped IPv6 addresses. This occurs because the Node.js WHATWG URL parser normalizes IPv4 addresses inside brackets to compressed hex form, which the library's regex does not detect. As a result, all seven IANA private IPv4 ranges, including cloud metadata IPs, are bypassed. Applications relying on isSSRFSafeURL() for SSRF protection are fully exposed to SSRF attacks. A patch is available, and the vendor manages remediation for this cloud-hosted service.
JunoClaw is an agentic AI platform built on Juno Network. Prior to 0.x.y-security-1, substring-based blocklist in plugin-shell's command-safety check could be bypassed by adversarial argument constructions, allowing unauthorized command execution on the host when combined with the companion advisory. Pre-patch, the check was applied to the raw command string rather than the parsed first token. This vulnerability is fixed in 0.x.y-security-1.
OpenClaw versions before 2026.4.23 have an improper access control vulnerability in the gateway tool's config.apply and config.patch operations. This flaw allows compromised models to bypass an incomplete denylist and make unsafe configuration changes. These malicious modifications can persist across restarts and impact command execution, network behavior, credentials, and operator policies.
CVE-2026-43584 is a high-severity vulnerability in OpenClaw before version 2026.4.10. It involves an incomplete denylist of environment variables in the exec environment policy, allowing operator-supplied overrides of critical interpreter startup variables such as VIMINIT, EXINIT, LUA_INIT, and HOSTALIASES. This can be exploited by attackers to manipulate execution behavior or network connectivity downstream.
OpenClaw versions 2026.3.31 before 2026.4.10 have a critical privilege escalation vulnerability due to incomplete detection of local background async exec completion events. This flaw allows attackers to provide untrusted completion content, potentially causing a process to run with higher privileges than intended.
Vvveb before version 1.0.8.2 contains an authenticated remote code execution vulnerability in the admin code editor that allows low-privilege authenticated users to execute arbitrary code through insufficient file extension restrictions, with the uploaded payload then executable via subsequent unauthenticated HTTP requests. Attackers with editor, author, contributor, or site_admin roles can write a malicious .htaccess file to map arbitrary extensions to the PHP handler, then upload PHP code with that extension to achieve unauthenticated remote code execution when the file is accessed via HTTP.
OpenClaw versions 2026.4.7 prior to 2026.4.14 contain a critical privilege escalation vulnerability due to incomplete filtering of untrusted webhook wake events. This flaw allows attackers to send specially crafted webhook events that bypass the intended owner downgrade logic, preserving elevated execution context improperly.
OpenClaw versions 2026.4.7 before 2026.4.10 contain a vulnerability where Discord event cover image parameters are not properly normalized during sandbox media processing. This incomplete input validation allows attackers to bypass media normalization and inject host-local media references into channel action paths that expect normalized media.
OpenClaw versions =2026.2.22 contain a vulnerability due to incomplete detection of disallowed inputs in its shell-wrapper. This flaw allows attackers to inject environment variable assignments at the argv level, bypassing exec preflight handling. Manipulation of high-risk shell variables such as SHELLOPTS and PS4 can alter execution semantics and security controls, posing a significant security risk.
Xibo CMS versions 1.7 through 4.4.0 contain an SQL injection vulnerability in the API routes responsible for filtering DataSets. This flaw allows an authenticated user with specific privileges to inject malicious SQL commands via the API filter parameter, potentially leading to unauthorized data access and modification. The issue is fixed in version 4.4.1. Customers hosting CMS with Xibo Signage have been patched for supported versions. Upgrading to version 4.
FlowiseAI Flowise versions prior to 3.1.0 contain a critical remote code execution vulnerability (CVE-2026-41264) in the CSV_Agents class. This vulnerability is due to insufficient sandboxing of Python scripts generated by the LLM, which allows unauthenticated attackers to execute arbitrary Python code with the privileges of the Flowise server user. The issue is fixed in version 3.1.0.
PySpector versions prior to 0.1.8 contain an incomplete blocklist in the PluginSecurity.validate_plugin_code function, allowing bypass of input restrictions via unfiltered Python constructs. This can enable an attacker who supplies a malicious plugin file to execute arbitrary code within the PySpector process. The issue is fixed in version 0.1.8.
Xerte Online Toolkits versions 3.15 and earlier contain an incomplete input validation vulnerability in the elFinder connector endpoint that fails to block PHP-executable extensions .php4 due to an incorrect regex pattern. Unauthenticated attackers can exploit this flaw combined with authentication bypass and path traversal vulnerabilities to upload malicious PHP code, rename it with a .php4 extension, and execute arbitrary operating system commands on the server.
October is a Content Management System (CMS) and web platform. Prior to 3.7.14 and 4.1.10, a vulnerability was identified in the Twig sandbox security policy that allowed database write operations when cms.safe_mode is enabled. Backend users with Developer permissions could use Twig template markup to execute insert, update, and delete operations on any database table through the query builder, which is included in the sandbox allow-list. This vulnerability is fixed in 3.7.14 and 4.1.10.
October is a Content Management System (CMS) and web platform. Prior to 3.7.14 and 4.1.10, a server-side information disclosure vulnerability was identified in the handling of CSS preprocessor files. Backend users with Editor permissions could craft .less, .sass, or .scss files that leverage the compiler's import functionality to read arbitrary files from the server. This worked even with cms.safe_mode enabled. This vulnerability is fixed in 3.7.14 and 4.1.10.