187720 matches found
CVE-2026-110205
Roo Code through 3.54.0 contains a command approval bypass vulnerability in parseCommandLine that discards command substitutions placed next to or ? glob characters. Attackers using indirect prompt injection can craft commands like echo $... that match allowlisted prefixes, executing denied...
CVE-2026-110206
Roo Code through 3.54.0 contains a command approval bypass vulnerability in parseCommandLine that allows attackers to auto-approve arbitrary shell commands by placing a command substitution in command position. Attackers using indirect prompt injection can submit commands like $echo touch /tmp/x...
CVE-2026-110204
Roo Code through 3.54.0 contains a command approval bypass vulnerability that allows attackers to run denied shell commands because parseCommandLine treats $ command; substitutions as parameter expansions. Attackers using indirect prompt injection can embed denied commands inside an allowlisted...
CVE-2026-110202
Roo Code through 3.54.0 contains a command approval bypass vulnerability in getCommandDecision that allows attackers to auto-approve denied shell commands by prefixing them with a bare & redirect. Attackers using indirect prompt injection can make the allowlist match a redirect target like echo...
CVE-2026-110203
Roo Code through 3.54.0 contains a command approval bypass vulnerability that allows attackers to auto-approve denied shell commands by abusing quote-masking regex in parseCommandLine. Attackers can use indirect prompt injection with escaped or single-quoted double quotes to hide command separato...
CVE-2026-100207
Improper neutralization of special elements used in an os command 'os command injection' in Azure CycleCloud allows an authorized attacker to execute code locally...
CVE-2026-86022 VNote: Argument injection to arbitrary command execution via crafted note filename in external-program handling
VNote is a note-taking platform. Prior to 4.3.0, SessionConfig::ExternalProgram::fetchCommand wraps a note path in double quotes and substitutes it into a command string that QProcess::startconst QString& reparses into arguments through ProcessUtils::startDetached. The automatic path in...
CVE-2026-86022 VNote: Argument injection to arbitrary command execution via crafted note filename in external-program handling
VNote is a note-taking platform. Prior to 4.3.0, SessionConfig::ExternalProgram::fetchCommand wraps a note path in double quotes and substitutes it into a command string that QProcess::startconst QString& reparses into arguments through ProcessUtils::startDetached. The automatic path in...
EUVD-2026-100523
VNote is a note-taking platform. Prior to 4.3.0, SessionConfig::ExternalProgram::fetchCommand wraps a note path in double quotes and substitutes it into a command string that QProcess::startconst QString& reparses into arguments through ProcessUtils::startDetached. The automatic path in...
CVE-2026-86022
The note-taking platform VNote (prior to version 4.3.0 ) is vulnerable to argument injection leading to arbitrary command execution. The root cause lies in SessionConfig::ExternalProgram::fetchCommand, which wraps a note path in double quotes before passing it to QProcess::start(const QString&) v...
CVE-2026-55601 MultiTail: Shell injection in execute-on-match command handling
MultiTail is a utility for monitoring multiple log files in one terminal. In version 7.1.5 and earlier, the -ex and -eX execute-on-match feature appended attacker-controlled matched input to a configured command inside double quotes, then checkfilterexec in mt.c passed the constructed command...
EUVD-2026-100521
MultiTail is a utility for monitoring multiple log files in one terminal. In version 7.1.5 and earlier, the -ex and -eX execute-on-match feature appended attacker-controlled matched input to a configured command inside double quotes, then checkfilterexec in mt.c passed the constructed command...
CVE-2026-55601
The log monitoring utility MultiTail (version 7.1.5 and earlier ) is vulnerable to a shell injection flaw within its -ex and -eX execute-on-match features. The root cause lies in the check_filter_exec() function in mt.c, which passes a constructed command—containing unsafely escaped attacker-cont...
CVE-2026-48030
CVE-2026-48030 — OS Command Injection in Pheditor Overview Field| Details ---|--- CVE ID| CVE-2026-48030 Product| pheditor Vendor| Hamid Samak Affected Versions| 2.0.1, 2.0.2, 2.0.3 Patched Version| 2.0.4 Severity| Critical CVSS Score| 9.9 CVSS Vector| CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H...
EUVD-2026-100460
Improper neutralization of special elements used in a command 'command injection' in Microsoft Office OneNote allows an unauthorized attacker to execute code over a network...
CVE-2026-97781
A command injection vulnerability exists in Microsoft Office OneNote due to the improper neutralization of special elements used in a command. This flaw allows an unauthorized attacker to achieve remote code execution over a network. The vulnerability is rated with a High severity (CVSS 8.8) and ...
EUVD-2026-100318
Improper neutralization of special elements used in an os command 'os command injection' in Azure CycleCloud allows an authorized attacker to execute code locally...
CVE-2026-100207
A vulnerability in Azure CycleCloud involving improper neutralization of special elements used in an OS command (OS command injection) allows an authorized attacker to execute code locally . This flaw is associated with CWE-78 and has a CVSS 3.1 base score of 7.3 . While the vulnerability was ide...
CVE-2026-96951
The Windows Shell is vulnerable to a security feature bypass (CVE-2026-96951) caused by improper neutralization of special elements used in a command (command injection). This flaw affects Windows 10 , Windows 11 , and certain Server versions , and was also identified in Outlook.com cloud service...