Threats Tagged 'cwe-829'

Inclusion of functionality from untrusted control sphere in .NET allows an unauthorized attacker to disclose information over a network.

Inclusion of functionality from untrusted control sphere in Visual Studio Code - Python extension allows an unauthorized attacker to bypass a security feature locally.

Inclusion of Functionality from Untrusted Control Sphere vulnerability in the HTML5 scrubber in rrrene html_sanitize_ex allows a remote attacker to load a document of their choosing into a trusted page via the data attribute of an <object> element in sanitized HTML. object is the one URI-bearing element in lib/html_sanitize_ex/scrubber/html5.ex never registered through allow_tag_with_uri_attributes/3, and its only guard is a prefix match on lowercase "javascript:", so mixed-case variants, data: URIs, protocol-relative URLs and same-origin paths all survive. This is not unconditional cross-site scripting. A javascript: URL does not execute through <object data> in current browsers, data: documents load in an opaque origin, and host-origin script execution additionally requires the application to serve attacker-controlled content from a same-origin path. This issue affects html_sanitize_ex: from 0.3.1 before 1.5.3.

PraisonAI is a multi-agent teams system. In versions 3.9.26 through 4.6.57 of praiseonai and 0.12.12 through 1.6.57 of praiseonaiagents, the workflow "include" feature is vulnerable to code execution. Workflow._execute_include() implicitly imports and runs an included recipe's tools.py via a raw importlib.util.spec_from_file_location() and spec.loader.exec_module() call, without honoring the PRAISONAI_ALLOW_TEMPLATE_TOOLS/PRAISONAI_ALLOW_LOCAL_TOOLS autoload opt-in gates or routing through the centralized safe loader that protects the other tools.py autoload paths. As a result, a workflow that includes an attacker-controlled local recipe directory executes arbitrary module-level Python code during include setup, before any child workflow parsing or model call, and the same sink is reachable through the higher-level praisonai.recipe.run() recipe API. An attacker who can cause a victim process to run a workflow or recipe that includes an untrusted local recipe achieves arbitrary Python code execution as the PraisonAI process user, a variant that bypasses the hardening applied to the previously disclosed automatic tools.py RCE advisory family. This issue has been fixed in version 4.6.58 of praisonai and 1.6.58 of praisonaiagents.

Google::Auth versions before 0.06 for Perl run a command named in an external_account credentials JSON via an ungated system call. The Pluggable subclass reads credential_source.executable.command from the credentials JSON and runs it as `system($command)`, a single argument call that passes the whole string to /bin/sh -c. The executable's environment_variables map from the same JSON is copied into %ENV first. No opt-in gate guards the call. make_creds selects the Pluggable subclass whenever credential_source.executable is present, so the path is reached from the standard Application Default Credentials flow, including a "type": "external_account" configuration read from the file named by GOOGLE_APPLICATION_CREDENTIALS. Configurations without credential_source.executable do not select this subclass and do not reach the call. Any caller that builds credentials from a configuration it does not fully control runs the embedded command with the privileges of the application process.

PDM is a Python package and dependency manager. In versions up to and including 2.26.9, PDM automatically loads project-local plugins from a .pdm-plugins directory during initialization, allowing an attacker-controlled file in an untrusted repository checkout to execute arbitrary Python code before any command is parsed. This happens because load_plugins() runs during Core.init() and adds .pdm-plugins via site.addsitedir(), which processes .pth files and immediately executes any line beginning with import, so the code runs with the privileges of the user invoking pdm and even a benign command such as pdm --version triggers it (making the impact strongest in CI, automation, and privileged contexts). The issue is fixed in version 2.27.0.

CVE-2026-65908 is a high-severity vulnerability in JetBrains PyCharm that allows arbitrary code execution via a malicious Python executable when opening an untrusted project. This affects versions before 2026.1.4 and certain 2026.2 versions. The vulnerability is related to CWE-829, which involves inclusion of functionality from untrusted control spheres. The CVSS score is 8.6, indicating a significant risk. No official patch or remediation guidance is currently provided by the vendor. Exploits in the wild are not known at this time.

A high-severity vulnerability (CWE-829) exists in JetBrains IntelliJ IDEA before version 2026.2 that allows arbitrary code execution prior to granting project trust when using development container configuration. This vulnerability requires local access and user interaction but can lead to full confidentiality, integrity, and availability compromise. No official patch or remediation guidance has been confirmed yet.

A high-severity vulnerability (CWE-829) in JetBrains PhpStorm before version 2026.2 allows arbitrary code execution prior to granting project trust via the configured interpreter. This means that an attacker could execute code without user authorization in affected versions. The vulnerability has a CVSS score of 8.4, indicating significant impact on confidentiality, integrity, and availability.

A high-severity vulnerability (CWE-829) exists in JetBrains PhpStorm before version 2026.2 that allows arbitrary code execution before the user grants project trust via project tooling. This vulnerability enables an attacker to execute code without user interaction or privileges. No patch or official remediation information is currently provided by the vendor.