Arbitrary Code Injection

Overview flowise-components is a Flowiseai Components Affected versions of this package are vulnerable to Arbitrary Code Injection via unsanitized string interpolation in the CSVAgent process. An attacker can execute arbitrary operating system commands, read sensitive files, steal credentials, an...

Arbitrary Code Injection

Overview flowise-components is a Flowiseai Components Affected versions of this package are vulnerable to Arbitrary Code Injection via the executeJavaScriptCode function. An attacker can execute arbitrary system commands as root by supplying crafted nodeVMOptions that override default sandbox...

Arbitrary Code Injection

Overview flowise is a Flowiseai Server Affected versions of this package are vulnerable to Arbitrary Code Injection via the executeJavaScriptCode function. An attacker can execute arbitrary system commands as root by supplying crafted nodeVMOptions that override default sandbox restrictions,...

Arbitrary Code Injection

Overview flowise-components is a Flowiseai Components Affected versions of this package are vulnerable to Arbitrary Code Injection via the additionalConfig input to the TypeORM DataSource class, which allows arbitrary options to be set. An attacker can achieve arbitrary code execution on the serv...

Arbitrary Code Injection

Overview flowise is a Flowiseai Server Affected versions of this package are vulnerable to Arbitrary Code Injection via the additionalConfig input to the TypeORM DataSource class, which allows arbitrary options to be set. An attacker can achieve arbitrary code execution on the server by uploading...

Arbitrary Code Injection

Overview getgrav/grav is a Modern, Crazy Fast, Ridiculously Easy and Amazingly Powerful Flat-File CMS. Affected versions of this package are vulnerable to Arbitrary Code Injection via the Blueprint::isSafeDynamicCall process. An attacker can execute arbitrary public static PHP methods with...

Arbitrary Code Injection

Overview sentence-transformers is a State-of-the-Art Text Embeddings Affected versions of this package are vulnerable to Arbitrary Code Injection through the importmoduleclass function in sentencetransformers/util/misc.py due to a logic flaw that allows the security guard to be bypassed if a loca...

Arbitrary Code Injection

Overview @aws-amplify/codegen-ui-react is an Amplify UI React code generation implementation Affected versions of this package are vulnerable to Arbitrary Code Injection through the ReactThemeStudioTemplateRenderer in packages/codegen-ui-react/lib/react-theme-studio-template-renderer.ts. An...

CVE-2026-12946: Improper Control of Generation of Code

IBM Langflow OSS 1.0.0 through 1.10.0 could allow a remote attacker to inject arbitrary code on the system, due to the improper control of user input code...

Arbitrary Code Injection

Overview Affected versions of this package are vulnerable to Arbitrary Code Injection via the selecteval custom field type. An attacker can execute arbitrary Ruby code on the server by supplying a malicious expression in the field options command parameter, which is evaluated through instanceeval...

Arbitrary Code Injection

Overview datamodel-code-generator is a Datamodel Code Generator Affected versions of this package are vulnerable to Arbitrary Code Injection via the x-python-type extension in JSON Schema processing. An attacker can execute arbitrary code by supplying a crafted JSON Schema that injects malicious...

Arbitrary Code Injection

Overview datamodel-code-generator is a Datamodel Code Generator Affected versions of this package are vulnerable to Arbitrary Code Injection via the customBasePath schema field. An attacker can execute arbitrary Python code by supplying a specially crafted value containing embedded newlines and a...

CVE-2026-64815

In JetBrains IntelliJ IDEA before 2026.2 arbitrary code injection was possible via UI Designer form files...

CVE-2026-64815: Improper Control of Generation of Code

In JetBrains IntelliJ IDEA before 2026.2 arbitrary code injection was possible via UI Designer form files...

Arbitrary Code Injection

Overview n8n-workflow is a Workflow base code of n8n Affected versions of this package are vulnerable to Arbitrary Code Injection via crafted expressions using arrow functions in the expression. An attacker can execute arbitrary system commands by bypassing the intended sandbox restrictions. Note...

Arbitrary Code Injection

Overview getgrav/grav is a Modern, Crazy Fast, Ridiculously Easy and Amazingly Powerful Flat-File CMS. Affected versions of this package are vulnerable to Arbitrary Code Injection via the dynamicData function. An attacker can execute arbitrary code by planting a malicious callable directive in a...

Arbitrary Code Injection

Overview uproot is a ROOT I/O in pure Python and NumPy. Affected versions of this package are vulnerable to Arbitrary Code Injection via the TStreamerInfo metadata processing. An attacker can execute arbitrary Python code by supplying a crafted ROOT file containing malicious streamer metadata...

Arbitrary Code Injection

Overview Affected versions of this package are vulnerable to Arbitrary Code Injection through PythonConventionService.RemoveInvalidDescriptionCharacters and KiotaBuilder enum description handling in src/Kiota.Builder/Writers/Python and src/Kiota.Builder/KiotaBuilder.cs. An attacker can execute...

Arbitrary Code Injection

Overview Affected versions of this package are vulnerable to Arbitrary Code Injection through the C doc-comment generation in CSharpConventionService and OpenApiUrlTreeNodeExtensions. An attacker can inject executable C into generated clients by supplying description, externalDocs label, or link...

Arbitrary Code Injection

Overview praisonaiagents is a Praison AI agents for completing complex tasks with Self Reflection Agents Affected versions of this package are vulnerable to Arbitrary Code Injection via the plugin manager process. An attacker can execute arbitrary code by placing a malicious .py file in the plugi...