CVE-2026-57154 is a high-severity injection vulnerability in the OPNsense core firewall and routing platform prior to versions 26.1.11 and 26.4.1p1. Authenticated users with delegated access to certain settings can inject carriage return or line feed characters into single-line fields, causing privileged service configuration files to include attacker-controlled directives. This affects multiple services including Dnsmasq, OpenVPN, DHCPv6, Unbound, IPsec, NTP, PPP/MPD, Monit, firewall, sudo, WebGUI, and System General configuration. Exploitation can lead to altered service behavior, crossing of RBAC boundaries, denial of service, and in some cases root command execution. The issue is fixed in versions 26.1.11 and 26.4.1p1.
HTTP::Session versions before 0.54 for Perl allow memcached command injection via unfiltered session ids in HTTP::Session::Store::CHI.
The session id from the client's cookie reaches the CHI cache unchanged. The sibling HTTP::Session::Store::Memcached rejects ids that contain control characters, but the CHI store has no such check, and CHI does not escape keys for its memcached drivers.
With a memcached driver, a CR and LF in the session id end the cache command early, and the server reads the bytes after them as further commands.
The Contact Form by Supsystic WordPress plugin before 1.11.1 does not strip CR/LF characters or re-validate submitted field values before concatenating them into outgoing email headers when a form is configured to map a submitted field into its Reply-To, From or Cc header, allowing unauthenticated users to inject arbitrary email headers such as additional Bcc or Cc recipients into the notification email.
CVE-2026-115785 is a CRLF injection vulnerability in the SMTP command construction of Zimbra Collaboration Suite (ZCS) versions up to 10.1.20. An authenticated user with account options enabled can inject carriage return and line feed characters into the emailAddress field via a JSON SOAP request. This injection affects the SMTP envelope commands sent after a POP3 or IMAP login, potentially allowing the attacker to send emails with arbitrary recipients, headers, and body content without victim interaction. The vulnerability has a medium severity rating with a CVSS score of 4.3.
CVE-2026-114720 is an IMAP command injection vulnerability in Roundcube Webmail versions before 1.6.20 and 1.7.5. It allows a remote authenticated attacker to inject CRLF sequences into the _flag parameter of the mail/mark action, enabling execution of arbitrary IMAP commands. The issue is fixed in versions 1.6.20 and 1.7.5 by rejecting flags containing control, whitespace, and IMAP-special characters.
CVE-2026-113715 is a low-severity CRLF injection vulnerability in pypa virtualenv versions prior to 21.14.9. It allows an untrusted caller who can influence the destination pathname to inject line-boundary characters into the pyvenv.cfg file, altering configuration keys such as 'home' and 'include-system-site-packages'. This can weaken environment isolation or change the interpreter's standard library loading path. The issue is fixed in version 21.14.9.
ArmorX Spam by ArmorX Global Technology contains a command injection vulnerability (CWE-93) that allows authenticated remote attackers to inject crafted commands into a parameter, enabling malicious code upload to the server. This vulnerability affects versions prior to 8.15.2-3.282.133-1.90.061. It has a high severity rating with a CVSS score of 7.1. A fixed version 8.15.2-3.282.133-1.90.061 is available.
CVE-2026-113386 is a vulnerability in Roundcube Webmail versions before 1.6.20 and 1.7.5 that allows a remote authenticated attacker to inject CRLF sequences into the _uid parameter of certain IMAP-related actions, leading to arbitrary IMAP command execution.
The Subscribe to Comments WordPress plugin before 2.3.3 does not sanitise newline characters from a notification sender-name setting before using it in e-mail headers, allowing users with Author-level access and above to inject arbitrary e-mail headers, such as a hidden Bcc, and to spoof the sender.
OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, the cupsdCreateJob option-string builder in scheduler/job.c maps attacker-controlled destination-uri and pre-dial-string values from a configured fax queue to the phone and faxPrefix options. Unlike ordinary IPP job attributes, these mapped fax values bypass the control-character sanitizer and are copied directly into the filter options argument. A user permitted to submit a job can therefore inject control characters into the downstream option stream. The reporter states that a downstream fax filter passing these values to a shell or modem command could execute code as lp, while the maintainer states that CUPS has no confidentiality or integrity impact because the only known code-executing filter is optional Foomatic and addressed separately, leaving possible disruption of the affected queue. This issue is fixed in version 2.4.20.
CVE-2026-41504 is a CRLF injection vulnerability in the Native audit-log formatter of the Coraza WAF library versions 3.0.0 through 3.7.x. This flaw allows an attacker controlling certain request or response fields to inject carriage return and line feed characters into audit logs, potentially forging lines within transaction records. The vulnerability can mislead operators and disrupt line-oriented SIEM processing. The issue is fixed in version 3.8.0.
Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1 directly accepts Apache configuration file data during service setup or re-initialization. An attacker capable of corrupting the configuration structure will prevent the web management service from starting or recovering during service bring-up, leading to a persistent Denial of Service (DoS) of the administrative web interface.
An input validation and output encoding vulnerability exists in the web management interface of Brocade Fabric OS versions before 10.0.1. When configuring Federated Authentication (FA), the system fails to sanitize the Identity Provider (IdP) issuer parameter. An authenticated administrator—or an attacker capable of supplying crafted FA configuration files during an import routine—can inject arbitrary web server directives. This can lead to service denial by preventing the web management daemon from starting, or potentially alter web server security controls.
CVE-2026-102136 is a vulnerability in Kiteworks Core affecting multi-node deployments. An attacker with code execution on one node can submit crafted input via an internal cluster interface, which is insufficiently validated when written into monitoring configuration on another node. This can lead to execution of OS commands under an unprivileged service account on the second node. The vulnerability is classified as a CRLF injection (CWE-93) and impacts versions prior to 9.5.1. The CVSS score is 6.3, indicating a medium severity.
CVE-2026-102145 is a vulnerability in Kiteworks Core where an authenticated administrator can exploit improper neutralization of CRLF sequences (CRLF Injection). This flaw allows the server to issue requests to internal network services that should not be accessible through the interface. The vulnerability does not lead to code execution by itself.
### Summary
`pyvenv.cfg` is a line-based format with no escape syntax. `PyEnvCfg.write()` wrote values verbatim, while `PyEnvCfg._read_values()` parses the file with `str.splitlines()`. A value containing a line boundary therefore became additional configuration lines, and because reading is last-wins, the injected keys replaced any key written earlier in the file.
### Impact
The `prompt` value is the reachable input: it is set by `--prompt`, by the `VIRTUALENV_PROMPT` environment variable, or from the config file, and `write()` emits `prompt` before `home`. A crafted prompt can therefore set `home` in the generated `pyvenv.cfg`:
```console
$ virtualenv --prompt $'x"\nhome = /attacker/path\nprompt = "z' venv
$ grep '^home' venv/pyvenv.cfg
home = /attacker/path
```
`home` is what tooling reads to locate the base interpreter, so a consumer that trusts it can be pointed elsewhere. `implementation`, `version_info`, `version`, `executable`, `command` and `virtualenv` are also written before `prompt` and can be replaced the same way.
This requires the prompt to come from somewhere other than the person running the command, for example a CI job templating a branch name into it, tooling deriving an environment name from user-supplied data, or an inherited `VIRTUALENV_PROMPT`. Where the operator supplies the prompt directly they already control the command line, and the effect is corruption rather than privilege gain: the value is truncated at the boundary and read back with a dangling quote.
### Details
The boundary set is the one `str.splitlines()` recognizes, which is wider than `\n`: `\r`, `\v`, `\f`, the file, group and record separators, `U+0085`, `U+2028` and `U+2029` were all written through unchanged and all split the line when read back.
### Patches
`PyEnvCfg.write()` now collapses those boundaries to spaces as it serializes each line, so it cannot emit a structurally invalid file regardless of what a caller places in `content`.
### Workarounds
Do not pass externally influenced data as the virtualenv prompt. Strip line boundaries from any value before using it as `--prompt` or `VIRTUALENV_PROMPT`.
Improper neutralization of CRLF sequences in IMAP command construction in psyb0t/docker-mailbox before 0.4.13 allows a remote unauthenticated attacker, when bearer-token authentication is not configured, to inject additional IMAP commands into an authenticated upstream mailbox connection via crafted folder, UID, or search values.
CVE-2026-61815 is a CRLF injection vulnerability in the zbateson mail-mime-parser library affecting versions prior to 3.0.6 and between 4.0.0 and before 4.0.2. The flaw allows attacker-controlled attachment filenames containing carriage-return and line-feed characters to inject additional MIME headers, potentially enabling header injection attacks such as forged Bcc headers. This impacts applications that parse and re-send MIME messages using this library without sanitizing attachment filenames. Versions 3.0.6 and 4.0.2 include patches for this issue. Users of older 1.x and 2.x versions are advised to upgrade or sanitize filenames to mitigate risk.