Urwid versions prior to 4.0.7 contain a vulnerability in the handle_short_request() function in urwid/display/web.py where improper encoding and decoding of POST input and polling socket output can cause Unicode errors. An attacker with a valid session token can submit crafted input that triggers UnicodeEncodeError or UnicodeDecodeError, causing the CGI handler to return an error and terminate request processing. Additionally, the POST exception path leaves a file descriptor open, which can lead to denial of service through resource exhaustion. This issue is fixed in version 4.0.7.
JupyterLab Desktop versions prior to 4.6.2-1 contain a critical cross-site scripting (XSS) vulnerability. This flaw allows an attacker to execute arbitrary JavaScript code in the Welcome renderer by submitting crafted remote-server URLs, potentially leading to arbitrary code execution with the user's privileges. The vulnerability also involves unsafe rendering of RSS news-feed titles, which could be exploited if an attacker controls the content of the Jupyter Blog feed or its cached data. The issue affects all supported platforms and is fixed in version 4.6.2-1.
Zammad versions prior to 7.1.2 contain a stored cross-site scripting (XSS) vulnerability in the new Vue-based ticket interface. Authenticated users can inject markup into ticket articles that is rendered without proper output encoding when viewed by others. The default Content Security Policy (CSP) reduces the practical impact of this vulnerability. The classic REST/CoffeeScript interface is not affected. This issue is fixed in version 7.1.2.
CGI versions prior to 5.00 for Perl contain a vulnerability where unescaped double quotes in the Content-Disposition header's attachment filename parameter allow injection of a second filename parameter. This occurs because the header function writes the attachment name directly into the quoted filename parameter without escaping double quotes, potentially altering the filename under which a response is saved.
CGI::Cookie versions before 5.00 for Perl have a vulnerability where cookie attribute injection is possible via unvalidated path, domain, and expires values. These values are written into the Set-Cookie header without validation for semicolons or control characters, allowing an attacker to inject additional cookie attributes such as Domain or SameSite if the application sets these values from request data.
fastapi-code-generator creates FastAPI applications from OpenAPI files. Prior to 0.8.1, the generator inserts an OpenAPI path into a generated @app.get(...) route decorator as a single-quoted generated route string without escaping embedded quotes. An attacker-controlled or attacker-influenced OpenAPI path can close the string and inject a valid Python expression into the decorator argument. Syntax-breaking input only causes generation to fail, but syntactically valid generated code executes with the application's or CI process's privileges when the generated module is imported and the decorator is evaluated. This OpenAPI path sink is distinct from the project's separate operation-summary docstring and additional-response-key sinks. This issue is fixed in version 0.8.1.
CVE-2026-63469 is a critical code injection vulnerability in koxudaxi fastapi-code-generator versions prior to 0.8.1. The tool generates FastAPI applications from OpenAPI files and improperly inserts response status-code keys as single-quoted Python strings without escaping embedded quotes. This allows an attacker to inject arbitrary Python code if they control or influence a secondary response key in a multi-response operation. The injected code executes with the privileges of the application or CI process importing the generated module. The issue is fixed in version 0.8.1.
fastapi-code-generator versions prior to 0.8.1 contain a code injection vulnerability where unescaped triple quotes in Operation.summary allow injection of Python code into generated route-handler docstrings. This can lead to execution of attacker-controlled code with server process privileges when the affected route handler is invoked. The issue is fixed in version 0.8.1.
Elo is a purely functional expression language for no-code tools. Prior to 1.0.1, the Ruby backend in src/compilers/ruby.ts embeds attacker-controlled text in Ruby double-quoted strings without escaping #, so Ruby interpolation forms in the string-literal emitter or the labelled subtype-constraint branch become executable Ruby. The affected entry points include the /try playground with the Ruby target, bin/eloc -t ruby -x, and defaultFormats.elo.parse() followed by Ruby emission. A failing labelled subtype constraint evaluates its message, while an ordinary string literal is evaluated when the compiled Ruby runs, allowing Ruby code and shell command execution through backticks. JavaScript, Python, and SQL emission are not affected by this Ruby-specific path. This issue is fixed in version 1.0.1.
Improper encoding or escaping of output in Apache Wicket.
org.apache.wicket.core.util.string.JavaScriptUtils#escapeQuotes() replaces each single quote in its input with a backslash and a single quote, and each double quote with a backslash and a double quote, so that the value can be placed inside a JavaScript string literal. It does not escape the backslash, which is the character that has to be escaped, and escaped first, for the rest of that escaping to hold. A value that already holds a backslash immediately before a quote therefore ends up with two backslashes in front of that quote: the first escapes the second, the quote itself is left unescaped, and it closes the literal. Whatever the value carries after that point is no longer text but JavaScript, and it runs in the application's origin and in the session of the user looking at the page. The method is public, is not deprecated, and its documentation states that its result can be part of a JavaScript call such as an alert; the only limitation it notes concerns JSON values, which need different escaping.
An application is affected wherever it calls the method itself and places the result inside a JavaScript string literal, from its own code or from a component of its own or of a third party, and the value it escapes holds data an attacker can influence. There is no further condition, and no component of Wicket has to be involved: the application is using the method for what its documentation offers, and the method does not deliver it.
Two components shipped with Wicket Extensions pass a value through the method. org.apache.wicket.extensions.ajax.markup.html.AjaxEditableLabel writes the editor's first error feedback message into a single-quoted JavaScript string literal in the Ajax response, so an application is affected through that component where the message shown for a failed edit holds data an attacker can influence, whether that is the submitted value itself or another variable the application sets on the validation error. A validation message can carry the submitted value, because input is a message variable that every form component supplies for its own validation errors, and the documentation shows overriding a validator's message to include it; none of the message bundles shipped with Wicket interpolates it, so an application that has not written such a message is not affected through this component. org.apache.wicket.extensions.ajax.markup.html.repeater.AjaxListPanel passes the serialized markup tag of an appended component through the method and is not affected: the tag comes from the panel's own markup file, and a quote in any of its attribute values, the component's markup id included, is written as a character reference by the tag serialization and cannot close the literal.
This issue affects Apache Wicket: from 8.0.0 through 8.19.0, from 9.0.0 through 9.24.0, from 10.0.0 through 10.11.0. Users of Apache Wicket 7.x or older, which are no longer supported, should upgrade to a supported version.
Users are recommended to upgrade to version 8.20.0, 9.25.0 or 10.12.0, which fix the issue.
CVE-2026-63346 is a code injection vulnerability in the christianhelle refitter tool prior to version 2.1.2. The flaw occurs because header parameter names are inserted verbatim into a C# attribute string without escaping quotation marks, allowing an attacker to inject malicious code. This can lead to execution of attacker code at application startup via a generated assembly, even if the client is never called. The issue is fixed in version 2.1.2.
CVE-2026-63344 is a high-severity code injection vulnerability in the christianhelle refitter tool prior to version 2.1.2. The flaw arises because content-type keys from OpenAPI descriptions are inserted verbatim into Refit attribute strings without escaping, allowing crafted input to break out of the attribute context and inject a top-level class with a ModuleInitializer method. This method executes attacker code when the generated assembly loads, without requiring client calls. The issue affects refitter versions before 2.1.2 and is fixed in 2.1.2.
The Export and Import Users and Customers WordPress plugin (versions up to 2.7.5) contains a privilege escalation vulnerability due to inconsistent CSV escape character handling between export and import functions. An attacker with Subscriber-level access can craft CSV data that, when re-imported, creates a new Administrator account, allowing full control over the site.
CVE-2026-118257 is a high-severity cross-site scripting (XSS) vulnerability in the vue-i18n internationalization plugin for Vue.js. The flaw exists in versions 9.14.5, 10.0.8, and from 11.1.10 up to but not including 11.4.14, as well as from 12.0.0-alpha.4 up to but not including 12.0.0-alpha.5. The vulnerability arises because the sanitizeTranslatedHtml() function escapes markup and event-handler text inside an iframe srcdoc attribute but leaves the srcdoc attribute active, allowing browsers to parse attacker-controlled content as same-origin HTML and execute scripts when escapeParameter is enabled and translations are rendered as HTML via v-html. This issue is fixed in versions 11.4.14 and 12.0.0-alpha.5.
A cross-site scripting (XSS) vulnerability exists in the vue-i18n internationalization plugin for Vue.js in versions from 9.0.0-beta.5 up to but not including 11.4.14, and from 12.0.0-alpha.1 up to but not including 12.0.0-alpha.5. The issue occurs when escapeParameter (escapeParameterHtml in the Legacy API) is enabled but does not properly escape named interpolation values if both list and named values are supplied in the same translation call. This can allow attacker-controlled HTML markup injection, potentially leading to phishing or script execution when combined with other vulnerabilities or in versions lacking a sanitizer. The vulnerability is fixed in versions 11.4.14 and 12.0.0-alpha.5.
### Summary
`qs.stringify` with `allowEmptyArrays: true` writes the key of an empty array without encoding it, even though keys are encoded by default. A key that contains `&` (or the configured `delimiter`), `=`, or `#` therefore becomes query string syntax instead of data, so a caller-supplied key name can add parameters to the serialized query string, or cut it short.
### Details
In `lib/stringify.js`, the `allowEmptyArrays` branch returns `adjustedPrefix + '[]'` early, before the code that passes every other key through `encoder` and `formatter`. So `{ "x&k=v": ["1"] }` serializes as `x%26k%3Dv%5B0%5D=1`, but `{ "x&k=v": [] }` serializes as `x&k=v[]`. The early return applies at any depth (`{ "a": { "b&k=v": [] } }` gives `a[b&k=v][]`), under every `arrayFormat`, with `allowDots`, and with a custom `encoder`, which is never called for that key. With `encode: false` or `encodeValuesOnly: true`, keys are intentionally left unencoded on every path; those configurations are not affected.
#### PoC
```js
var qs = require("qs");
var query = qs.stringify({ q: "hi", "x&apiKey=evil&y": [] }, { allowEmptyArrays: true });
// "q=hi&x&apiKey=evil&y[]"
qs.parse(query);
// { q: "hi", x: "", apiKey: "evil", y: [""] }
qs.stringify({ "x#": [], z: "1" }, { allowEmptyArrays: true });
// "x#[]&z=1": in a URL, everything after "#" becomes the fragment
```
#### Fix
Applied in 234d505 on `main` and released as v6.17.0, and backported to v6.16.2, v6.15.4, v6.14.3, v6.13.4, and v6.12.6: the key of an empty array goes through `encoder` and `formatter` exactly as the key of any other value does, so `{ "x&apiKey=evil&y": [] }` now serializes as `x%26apiKey%3Devil%26y[]`. Keys that need no encoding serialize as before, with two exceptions that match every other path: the brackets of a nested key are now encoded (`a[b][]` becomes `a%5Bb%5D[]`, which `qs.parse` reads identically), and with `encodeDotInKeys`, a dot in the key becomes `%252E` instead of `%2E` (which `decodeDotInKeys` previously misread as nesting).
### Affected versions
- `>=6.12.0 <6.12.6`, fixed in v6.12.6
- `>=6.13.0 <6.13.4`, fixed in v6.13.4
- `>=6.14.0 <6.14.3`, fixed in v6.14.3
- `>=6.15.0 <6.15.4`, fixed in v6.15.4
- `>=6.16.0 <6.16.2`, fixed in v6.16.2
v6.17.0 and later are not affected.
`allowEmptyArrays` was introduced in f22b2bc and first shipped in v6.12.0, with this early return. Earlier versions have no `allowEmptyArrays` option and are not affected.
### Impact
An application that passes an object whose key names come from untrusted input to `qs.stringify` with `allowEmptyArrays: true` (for example, to forward a parsed JSON body or user-selected fields to an upstream service) can have parameters injected into the resulting query string. The injected parameters are not keys of the object, so deleting or overwriting a key on the object (such as setting a trusted `apiKey` after copying the user's fields) does not remove them; whether the attacker's value or the application's wins depends on how the receiving side handles a duplicate parameter. A `#` in such a key ends the query string early when the result is placed in a URL. `allowEmptyArrays` is off by default, and only keys whose value (after any `filter`) is an empty array are affected.
A Cross-site Scripting (XSS) vulnerability exists in the lxsmnsyc seroval library's JavaScript-output APIs prior to version 1.0.0 and from 1.5.5 up to but not including 1.6.10. The issue arises when serializing RegExp sources containing a less-than character without proper escaping for embedding in HTML script elements. This can allow an attacker to inject malicious scripts if untrusted input is serialized and embedded in a script element. The vulnerability is fixed in version 1.6.10.
CVE-2026-55442 is an improper input validation vulnerability in intranda goobi-viewer-core affecting versions from 23.03 up to but not including 26.05. The issue involves the SolrTools.cleanUpQuery() method, which attempts to sanitize user-supplied query strings by stripping Solr local-parameter syntax. However, the sanitization can be bypassed by wrapping the local parameter in double curly braces, allowing a valid Solr local parameter to be forwarded. This flaw affects any endpoint using this sanitizer. The vulnerability has been patched in version 26.05.
Heimdall versions prior to 0.17.17 improperly validate client IP addresses extracted from Forwarded and X-Forwarded-For headers when the trusted_proxies option is configured. The service accepts arbitrary strings, malformed IP literals, and unknown or obfuscated identifiers without proper syntax validation. Additionally, the Forwarded header parser incorrectly splits quoted strings, potentially causing malformed parsing of client IP addresses. This vulnerability was fixed in version 0.17.17.
Flexible GraphRAG versions from 0.6.0 up to but not including 0.8.2 contain an improper encoding vulnerability in the _escape() helper function used in Cypher query construction. This flaw allows attacker-controlled document content to inject Cypher clauses that can modify or delete graph data and potentially disclose sensitive graph information. The issue arises when quotes are escaped before backslashes, enabling escape doubling and premature string termination. Dynamic node and relationship type identifiers are also unsafely inserted without parameterization. The vulnerability is fixed in version 0.8.2.