Arbitrary Code Injection

Overview Affected versions of this package are vulnerable to Arbitrary Code Injection via XAML parsing in Windows Presentation Foundation WPF. An attacker can execute arbitrary code by supplying specially crafted XAML input that is processed by a vulnerable WPF application. Improper handling of...

Arbitrary Code Injection

Overview Affected versions of this package are vulnerable to Arbitrary Code Injection via XAML parsing in Windows Presentation Foundation WPF. An attacker can execute arbitrary code by supplying specially crafted XAML input that is processed by a vulnerable WPF application. Improper handling of...

Arbitrary Code Injection

Overview Affected versions of this package are vulnerable to Arbitrary Code Injection via XAML parsing in Windows Presentation Foundation WPF. An attacker can elevate privileges by supplying specially crafted XAML input that is improperly processed by a vulnerable WPF application. Successful...

Arbitrary Code Injection

Overview Affected versions of this package are vulnerable to Arbitrary Code Injection via the process that inserts the android:versionName value from an AndroidManifest into the generated app/build.gradle Groovy template without proper sanitization. An attacker can execute arbitrary code by...

Arbitrary Code Injection

Overview Affected versions of this package are vulnerable to Arbitrary Code Injection via the process that inserts the android:versionName value from an AndroidManifest into the generated app/build.gradle Groovy template without proper sanitization. An attacker can execute arbitrary code by...

Arbitrary Code Injection

Overview Affected versions of this package are vulnerable to Arbitrary Code Injection via the htmlcontent process. An attacker can execute arbitrary scripts in the browsers of visitors by injecting malicious HTML or JavaScript into an HTML block that is rendered without proper sanitization. This ...

Arbitrary Code Injection

Overview getgrav/grav is a Modern, Crazy Fast, Ridiculously Easy and Amazingly Powerful Flat-File CMS. Affected versions of this package are vulnerable to Arbitrary Code Injection via the offsetGet filter. An attacker can access sensitive configuration data, including secrets such as SMTP...

Arbitrary Code Injection

Overview craftcms/cms is a content management system. Affected versions of this package are vulnerable to Arbitrary Code Injection in the actionRenderCardPreview process. An attacker can execute arbitrary PHP code and disclose sensitive information by injecting malicious event handlers into the...

Arbitrary Code Injection

Overview org.dspace:dspace-api is a DSpace core data model and service APIs. Affected versions of this package are vulnerable to Arbitrary Code Injection through the Velocity template processing in org.dspace.core.LDN and org.dspace.core.Email. An attacker with DSpace administrator credentials ca...

Arbitrary Code Injection

Langroid is vulnerable to Arbitrary Code Injection. The vulnerability is due to improper sandboxing of Python eval that fails to remove builtins, which allows an attacker to execute arbitrary operating system commands through crafted LLM-generated tool messages...

Arbitrary Code Injection

Overview langroid is a Harness LLMs with Multi-Agent Programming Affected versions of this package are vulnerable to Arbitrary Code Injection in the eval process used by certain agent components when evaluating external input with fulleval=True. An attacker can execute arbitrary system commands b...

Arbitrary Code Injection

Overview megatron-bridge is a Megatron Bridge: Training Recipes for Megatron-based LLM and VLM models Affected versions of this package are vulnerable to Arbitrary Code Injection via the deserialization process. An attacker can execute arbitrary code, escalate privileges, tamper with data, and...

Arbitrary Code Injection

Overview Affected versions of this package are vulnerable to Arbitrary Code Injection via the alloperations process. An attacker can execute arbitrary Ruby code in the application process by supplying crafted operation names in a WSDL file. Remediation Upgrade savon to version 2.17.2 or higher...

Arbitrary Code Injection

Overview snowflake-cli is a Snowflake CLI Affected versions of this package are vulnerable to Arbitrary Code Injection in the Snowpark annotation processor template. An attacker can execute arbitrary code by supplying crafted project content that is interpolated into generated Python code during...

Arbitrary Code Injection

Overview mesop is a Build UIs in Python Affected versions of this package are vulnerable to Arbitrary Code Injection due to an explicit web endpoint inside the ai/ testing module infrastructure directly ingests untrusted Python code strings unconditionally without authentication measures, yieldin...

Arbitrary Code Injection

Overview Affected versions of this package are vulnerable to Arbitrary Code Injection via the path parameter in output plugins when using the $tag placeholder. An attacker can overwrite arbitrary files or inject malicious content by sending specially crafted log entries containing path traversal...

Arbitrary Code Injection

Overview prefect is a Prefect is a new workflow management system, designed for modern infrastructure and powered by the open-source Prefect Core workflow engine. Users organize Tasks into Flows, and Prefect takes care of the rest. Affected versions of this package are vulnerable to Arbitrary Cod...

Arbitrary Code Injection

Overview @tinacms/cli is a package used to set up your project with Tina Cloud configuration, and run a local version of the Tina Cloud content-api. Affected versions of this package are vulnerable to Arbitrary Code Injection through the addVariablesToCode/makeFieldsWithInternalCode process in...

Arbitrary Code Injection

Overview Affected versions of this package are vulnerable to Arbitrary Code Injection via the toCedarExpr method, which does not escape special characters when converting values to source code. An attacker can inject arbitrary expressions by supplying specially crafted input, potentially altering...

Arbitrary Code Injection

Overview Crawl4AI is a 🚀🤖 Crawl4AI: Open-source LLM Friendly Web Crawler & scraper Affected versions of this package are vulnerable to Arbitrary Code Injection via the browserconfig.extraargs parameter in API requests. An attacker can execute arbitrary commands as the container's runtime user by...