Threats Tagged 'cwe-829'

In JetBrains IntelliJ IDEA before 2026.2.2 missing project-trust confirmation before building a Dev Container allowed host-level code execution

In JetBrains IntelliJ IDEA before 2026.2.2 missing project-trust confirmation before building a Dev Container allowed host-level code execution

Dell PowerStore contains an Inclusion of Functionality from Untrusted Control Sphere vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability to execute arbitrary code with root privileges..

CVE-2026-76139 is a high-severity supply chain vulnerability in Red Hat Advanced Cluster Management for Kubernetes 2.11. The acm-operator-bundle build process downloads and executes a script from a remote source without verifying its authenticity, exposing sensitive build credentials such as GitHub tokens and registry passwords. This flaw allows a remote attacker to inject malicious code, potentially compromising build resources and the integrity of the resulting operator bundle. Red Hat has not provided a patch or mitigation that meets their criteria for ease of use and applicability. The vulnerability is rated with a CVSS score of 8.0, indicating a high impact on confidentiality, integrity, and availability.

CVE-2026-76139 is a high-severity vulnerability in the acm-operator-bundle component of Red Hat Advanced Cluster Management for Kubernetes 2.11. The build process downloads and executes a script from a remote source without verifying its authenticity or integrity. This allows a remote attacker to inject malicious code, potentially gaining unauthorized access to sensitive build credentials such as GitHub tokens and registry passwords, compromising build resources and the resulting operator bundle.

Download of code without integrity check, inclusion of functionality from untrusted control sphere, and cleartext transmission of sensitive information vulnerability in Ozols Grupa OZOLS on Windows caused by an abandoned auto-update domain. Affected component: the automatic update channel - OzolsSQL client update path, the <db>_update SQL Server Agent job (@subsystem = N'ActiveScripting') and serv_update.vbs. This issue affects OZOLS: before 1.1.1233.

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.22.0, Orval resolves remote and local external $ref values without an allowlist or confinement to the input directory. Processing an attacker-controlled OpenAPI description can cause requests from the developer or CI host to attacker-selected or internal HTTP services, read absolute or out-of-tree local files, and inline untrusted remote schemas into generated clients. The affected code is packages/orval/src/import-specs.ts external reference loading. This issue is fixed in version 8.22.0.

MyBooks is an enhanced and easy-to-use personal ebook management web server also known as Talebook. In 3.41.2 and earlier, the AdminSettings.post handler in webserver/handlers/admin.py accepts SOCIAL_AUTH key names without validating quotes or newline characters, and SettingsLoader.dumpfile in webserver/loader.py concatenates those names into the generated Python source file auto.py without escaping them. An administrator can submit a crafted SOCIAL_AUTH key name that closes the settings dictionary and injects arbitrary Python statements. The application later executes those statements because SettingsLoader.loadfile imports auto.py as a module, and setting autoreload to true invokes restart_async so a process supervisor restarts the service and triggers the import. Successful exploitation executes commands with the privileges of the application service account and can disclose data, modify files, establish persistence, or disrupt the service. Related authorization and registration vulnerabilities can reduce the effective privilege requirement in a chained attack, but the standalone vulnerability requires administrator access. This issue is fixed in version 3.42.0.

Unauthenticated Remote File Inclusion in Easy Google Maps < 1.14.2 versions.

CVE-2026-73851 is a path traversal vulnerability in Microsoft Kiota affecting versions prior to 1.29.1. It allows an attacker controlling the OpenAPI description to supply crafted file references that resolve outside the intended plugin package, potentially causing unauthorized file inclusion or disclosure. Initial mitigations rejected unsafe paths based on raw strings but failed to decode percent-encoded or obfuscated inputs, allowing bypasses. Subsequent fixes decode inputs before validation and reject control characters and Unicode homoglyphs. Users should upgrade to the first release after version 1.33.0 that includes these fixes. Workarounds include generating plugins only from trusted OpenAPI descriptions and reviewing manifests for unsafe file references.