Threats Tagged 'cwe-74'

Kakoune, a code editor, contains a vulnerability in its bundled autorestore.kak script prior to version 2026.05.21. This script is enabled by default and can be exploited by malicious backup files to execute arbitrary Kakoune and shell commands simply by opening a file. The issue is fixed in version 2026.05.21. A workaround is to disable the autorestore feature by adding 'autorestore-disable' to the user kakrc configuration.

The Ninja Forms WordPress plugin before 3.14.10 does not prevent user-supplied query-string input, used to pre-populate a form field's default value, from being processed as a shortcode, allowing unauthenticated attackers to execute arbitrary shortcodes registered on the site when a form so configured is embedded on a public page.

A command injection vulnerability exists in nearai ironclaw up to version 0.29.1 in the function classify_command_risk within src/tools/builtin/shell.rs. This vulnerability allows remote attackers with limited privileges to execute arbitrary commands. A patch identified by commit a1d7c3ba428ed575900469b207fb5668725f9a71 is available to address this issue. The vulnerability has a CVSS 3.1 score of 6.3, indicating a medium severity level.

SourceCodester Computer Repair Shop Management System 1.0 contains a SQL injection vulnerability in the /classes/Master.php?f=delete_product endpoint. The vulnerability allows remote attackers to manipulate the ID parameter, potentially leading to unauthorized data access or modification. The vulnerability has a CVSS score of 7.3, indicating a medium severity level. No patch or official remediation has been provided yet. Public exploit details have been disclosed, but no known exploitation in the wild has been reported.

A command injection vulnerability exists in OpenHands up to version 0.62.0 in the function initialize_repo within the file OpenHands/resolver/send_pull_request.py. This vulnerability allows remote attackers with limited privileges to execute arbitrary commands. The vulnerable code path was removed in version 1.7.0. No official patch or fix advisory is provided, but upgrading to version 1.7.0 or later appears to mitigate the issue.

A vulnerability identified as CVE-2026-19039 affects the Kino-Kafkaesque ssh-mcp-server up to a specific commit. It involves the ssh_exec function in the SSH Command Handler component, where manipulation of host or username arguments can lead to command injection. The vulnerability requires local access to exploit. The maintainers note that the server is intended as a local trusted tool, implying that callers already have significant execution privileges. The product uses a rolling release model, so exact affected versions are not specified. The CVSS score is 5.3, indicating a low severity level.

A vulnerability has been found in MissionSquad mcp-api up to 1.11.8. The impacted element is the function this.packageService.installPackage of the file src/controllers/packages.ts of the component NPM Package Version Handler. The manipulation leads to command injection. It is possible to initiate the attack remotely. Upgrading to version 1.11.9 is sufficient to resolve this issue. The identifier of the patch is a40f54d4533ba6618e1749383a245900eeb024c1. The affected component should be upgraded.

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in the CSS scrubber in rrrene html_sanitize_ex allows an unauthenticated remote attacker to inject CSS at-rules, including an import of a remote stylesheet, into a page served to other users. HtmlSanitizeEx.Scrubber.CSS.scrub/1 applies its property and value allowlist through a Regex.replace over substrings matching a property: value declaration pattern, so input that does not match that pattern is never inspected and is copied to the output unchanged. @import url(//attacker.example/style.css); survives, while the same URL inside a background: url(...) declaration is removed. Element boundaries are resolved before the scrubber runs, so injected content does not escape the <style> element and no script executes. This issue affects html_sanitize_ex: from 0.3.1 before 1.5.4.

hashi-vault-js is a Node.js module for interacting with the HashiCorp Vault API. Prior to 0.5.2, src/Vault.js concatenates unencoded identifier values including name, username, group, role, and version into Vault request paths and query strings instead of using encodeURIComponent() and URLSearchParams, allowing path traversal and query parameter injection. This issue is fixed in version 0.5.2.

A critical injection vulnerability (CVE-2026-54680) exists in kube-logging logging-operator versions prior to 6.6.0. The Fluentd configuration renderer writes certain CRD strings directly into configuration files without proper escaping, allowing an attacker with permission to create Flow resources to inject malicious Fluentd <match **> blocks. This can lead to arbitrary command execution within the Fluentd aggregator. The issue is resolved in version 6.6.0.