SEPPmail Secure Email Gateway versions before 15.1.1 contain a critical eval injection vulnerability (CWE-95) that allows unauthenticated remote attackers to execute arbitrary operating system commands as root. This occurs when attacker-controlled replacement text in sender or recipient replacement rules is evaluated as Perl code in the mail-processing worker context. The vulnerability is fixed in version 15.1.1.
Chamilo LMS is an open-source learning management system. In the 1.x line before 1.11.40, and the 2.x line before 2.0.1, multiple `eval()` calls in the vendored PEAR `HTML_QuickForm` libraries can execute arbitrary PHP code if form element names contain attacker-influenced data. Standard Chamilo forms use hardcoded element names; exploitation requires a developer-specific plugin or misconfiguration that lets user input reach those element names. Where that conditional path exists, the impact can be full server compromise. This issue is fixed in versions 1.11.40 and 2.0.1.
CVE-2026-115943 is a critical code execution vulnerability in Spreadsheet::XLSX for Perl versions before 0.19. It arises from unsafe use of string eval on number format conditions in ExcelFmt, allowing arbitrary Perl code execution when parsing a crafted XLSX file. The issue is fixed in version 0.19.
CVE-2026-90872 is an eval injection vulnerability in the Manager web console of Progress Software WS_FTP Server on Windows. It affects versions prior to 2024.0.7 and 2025.0.4. An authenticated Manager administrator could exploit this flaw to execute arbitrary commands with the privileges of the WS_FTP Server IIS worker process.
XWiki Pro Macros versions from 1.13 up to but not including 1.14.5 contain a critical eval injection vulnerability in the excerpt-include macro. This flaw allows users with page edit rights, even without scripting permissions, to inject executable macro syntax via the included page's title or excerpt content. Successful exploitation can lead to remote code execution with the macro's privileges, impacting confidentiality, integrity, and availability of the entire XWiki installation. The issue is resolved in version 1.14.5.
CVE-2026-78497 is a high-severity vulnerability in JQ-Lite for Perl versions before 2.51. It involves improper neutralization of directives in dynamically evaluated code, specifically an 'eval injection' via Perl code embedded in a query's regular expression. An attacker can supply malicious input that gets executed as Perl code in the calling process, leading to full compromise of confidentiality, integrity, and availability. The issue is fixed in version 2.51.
NVIDIA Isaac Lab contains a vulnerability where an attacker could cause an eval injection. A successful exploit of this vulnerability might lead to code execution, information disclosure, data tampering, and denial of service.
Affected devices do not properly restrict executable content contained in imported trace files.
This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importing a specially crafted trace file. Successful exploitation could allow attacker-controlled JavaScript to execute in the user’s browser session and perform PLC operations through the web server within the scope of the user’s authorization.
PHPCSUtils versions from 1.0.0-alpha1 up to 1.2.2 contain an eval injection vulnerability in the getActualArrayKey() function of AbstractArrayDeclarationSniff. This flaw allows attacker-controlled array-key expressions to be evaluated with eval(), enabling arbitrary command execution on the host scanning untrusted PHP code. The issue is fixed in version 1.2.3.
CVE-2026-108263 is a critical vulnerability in iflytek's astron-agent prior to version 1.1.2. It involves improper neutralization of directives in dynamically evaluated code, allowing an authenticated low-privilege tenant to execute arbitrary code as root within the core-workflow container. This can lead to unauthorized access to shared service and database credentials, bypassing tenant isolation, and enabling data compromise or service disruption. The issue is fixed in version 1.1.2.
Brocade ASCG before 3.5.0 improperly processes user input by evaluating form data prior to validation. When an authenticated user submits a configuration form, the submitted text could immediately be processed. A malicious actor with basic access can supply crafted input to execute arbitrary code on the server and take control of the application.
CVE-2024-42002 is a code injection vulnerability in the Robot Operating System 2 (ROS 2) 'ros2topic' command-line tool. It affects all ROS 2 distributions from Crystal Clemmys through Lyrical Luth and Rolling Ridley. The flaw exists in the 'hz' verb, which uses the --filter option to accept a user-supplied Python expression that is passed unsanitized to the eval() function. This allows a local user to execute arbitrary code. The vulnerability has a high severity score of 8.6 (CVSS 4.0). No patch or official remediation information is provided in the available data.
CVE-2026-100741 is a critical eval injection vulnerability in Progressive Robot Ltd's hMailServer versions 6.0.0 through 6.3.3 on Windows. It allows a remote unauthenticated attacker to execute arbitrary JScript code with service account privileges via crafted passwords or certain message fields when event scripting is enabled with JScript and specific event handlers are defined. The vulnerability does not affect VBScript event scripts or Linux builds. Exploitation requires non-default configurations enabling JScript event scripting and relevant handlers.
CVE-2026-57149 is a critical vulnerability in plone.app.portlets affecting versions 5.0.0 up to but not including 5.0.8, 6.0.0 up to but not including 6.0.4, and 7.0.0 up to but not including 7.0.2. The Classic portlet improperly evaluates user-supplied template/macro fields as full TALES expressions, allowing authenticated users with permission to configure Classic portlets to execute arbitrary code in the Plone server process. This leads to privilege escalation from an authenticated user to server-side code execution. The issue has been patched in versions 5.0.8, 6.0.4, and 7.0.2. Workarounds include restricting portlet management permissions and disabling the Classic portlet.
CVE-2026-76974 is a vulnerability in SAP Fiori Launchpad where insufficient validation of user-controlled input allows an unauthenticated attacker to craft malicious links. When an authenticated user clicks such a link, their browser may load attacker-controlled content from an external source. This can lead to exfiltration of sensitive information from the user's session, impacting confidentiality. There is no impact on integrity or availability.
XWiki Rendering is a generic rendering system that converts textual input in a given syntax (wiki syntax, HTML, etc) into another syntax (XHTML, etc). Prior to versions 14.10.2 and 15.0 RC1, any user who can edit their own user profile or any other document can execute arbitrary script macros including Groovy and Python macros that allow remote code execution including unrestricted read and write access to all wiki contents. The reason is that rendering output is included as content of HTML macros without further escaping and it is thus possible to close the HTML macro and inject script macros that are executed with programming rights. This has been patched in XWiki 14.10.2 and 15.0 RC1 by making sure that rendering output cannot close the surrounding HTML macro. A possible workaround is available. It is, in principle, possible to add escaping to all places where rendering output is used in wiki documents, but at the moment there is no list of them.
Redocly CLI makes OpenAPI validation, linting, and documentation workflows easier. Prior to version 2.33.0 of @redocly/respect-core and @redocly/cli, the respect command dynamically evaluates $faker runtime expressions in Arazzo descriptions. A crafted expression can traverse constructor, prototype, or __proto__ properties in packages/respect-core/src/modules/context-parser/get-value-from-context.ts, reach the JavaScript Function constructor, and execute arbitrary code when a user processes an untrusted description. The executed code runs with the privileges of the CLI process and can execute shell commands or read CI secrets. Users processing only trusted, self-authored workflows are not affected. This issue is fixed in @redocly/respect-core and @redocly/cli version 2.33.0.
CVE-2026-61667 is a critical SQL Injection vulnerability in DIRACGrid's DIRAC software framework for distributed computing. The flaw exists in the DataManagementSystem component where an authenticated user-controlled dataset value is unsafely interpolated into an SQL query without parameterization. This allows command execution via Python eval with the privileges of the DIRAC service account. Exploitation can lead to full system compromise, including exposure of configuration files, credentials, stored proxies, tokens, and alteration of local logs. The issue is fixed in DIRAC versions 8.0.79, 9.0.22, and 9.1.10.
CVE-2026-45579 is a critical eval injection vulnerability in DIRACGrid's DIRAC software framework for distributed computing. The flaw exists in the RequestManagementSystem component where an authenticated user-controlled attribute is evaluated as Python code, enabling arbitrary command execution. Exploitation can lead to exposure of sensitive configuration files, database passwords, stored proxies, tokens, and full system compromise including tampering with local logs. The vulnerability is fixed in DIRAC versions 8.0.79, 9.0.22, and 9.1.10.