CVE-2026-64815

In JetBrains IntelliJ IDEA before 2026.2 arbitrary code injection was possible via UI Designer form files...

CVE-2026-64815: Improper Control of Generation of Code

In JetBrains IntelliJ IDEA before 2026.2 arbitrary code injection was possible via UI Designer form files...

Arbitrary Code Injection

Overview n8n-workflow is a Workflow base code of n8n Affected versions of this package are vulnerable to Arbitrary Code Injection via crafted expressions using arrow functions in the expression. An attacker can execute arbitrary system commands by bypassing the intended sandbox restrictions. Note...

Arbitrary Code Injection

Overview typeorm is an ORM that can run in NodeJS, Browser, Cordova, PhoneGap, Ionic, React Native, NativeScript, Expo, and Electron platforms and can be used with TypeScript and JavaScript ES5, ES6, ES7, ES8. Affected versions of this package are vulnerable to Arbitrary Code Injection in the...

Arbitrary Code Injection

Overview getgrav/grav is a Modern, Crazy Fast, Ridiculously Easy and Amazingly Powerful Flat-File CMS. Affected versions of this package are vulnerable to Arbitrary Code Injection via the dynamicData function. An attacker can execute arbitrary code by planting a malicious callable directive in a...

Arbitrary Code Injection

Overview uproot is a ROOT I/O in pure Python and NumPy. Affected versions of this package are vulnerable to Arbitrary Code Injection via the TStreamerInfo metadata processing. An attacker can execute arbitrary Python code by supplying a crafted ROOT file containing malicious streamer metadata...

Arbitrary Code Injection

Overview Affected versions of this package are vulnerable to Arbitrary Code Injection through PythonConventionService.RemoveInvalidDescriptionCharacters and KiotaBuilder enum description handling in src/Kiota.Builder/Writers/Python and src/Kiota.Builder/KiotaBuilder.cs. An attacker can execute...

Arbitrary Code Injection

Overview Affected versions of this package are vulnerable to Arbitrary Code Injection through the C doc-comment generation in CSharpConventionService and OpenApiUrlTreeNodeExtensions. An attacker can inject executable C into generated clients by supplying description, externalDocs label, or link...

CVE-2026-59861

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.0, Kiota's Ruby generator embedded OpenAPI default fields, property names, and other schema-derived strings through CodeMethodWriter.cs and SanitizeForQuotedLiteral in Writers/StringExtensions.cs into Ruby double-quote...

Arbitrary Code Injection

Overview praisonaiagents is a Praison AI agents for completing complex tasks with Self Reflection Agents Affected versions of this package are vulnerable to Arbitrary Code Injection via the plugin manager process. An attacker can execute arbitrary code by placing a malicious .py file in the plugi...

Arbitrary Code Injection

Overview Affected versions of this package are vulnerable to Arbitrary Code Injection via XAML parsing in Windows Presentation Foundation WPF. An attacker can execute arbitrary code by supplying specially crafted XAML input that is processed by a vulnerable WPF application. Improper handling of...

Arbitrary Code Injection

Overview Affected versions of this package are vulnerable to Arbitrary Code Injection via XAML parsing in Windows Presentation Foundation WPF. An attacker can execute arbitrary code by supplying specially crafted XAML input that is processed by a vulnerable WPF application. Improper handling of...

Arbitrary Code Injection

Overview Affected versions of this package are vulnerable to Arbitrary Code Injection via XAML parsing in Windows Presentation Foundation WPF. An attacker can elevate privileges by supplying specially crafted XAML input that is improperly processed by a vulnerable WPF application. Successful...

Arbitrary Code Injection

Overview Affected versions of this package are vulnerable to Arbitrary Code Injection via the process that inserts the android:versionName value from an AndroidManifest into the generated app/build.gradle Groovy template without proper sanitization. An attacker can execute arbitrary code by...

Arbitrary Code Injection

Overview Affected versions of this package are vulnerable to Arbitrary Code Injection via the process that inserts the android:versionName value from an AndroidManifest into the generated app/build.gradle Groovy template without proper sanitization. An attacker can execute arbitrary code by...

Arbitrary Code Injection

Overview Affected versions of this package are vulnerable to Arbitrary Code Injection via the htmlcontent process. An attacker can execute arbitrary scripts in the browsers of visitors by injecting malicious HTML or JavaScript into an HTML block that is rendered without proper sanitization. This ...

Arbitrary Code Injection

Overview getgrav/grav is a Modern, Crazy Fast, Ridiculously Easy and Amazingly Powerful Flat-File CMS. Affected versions of this package are vulnerable to Arbitrary Code Injection via the offsetGet filter. An attacker can access sensitive configuration data, including secrets such as SMTP...

Arbitrary Code Injection

Overview craftcms/cms is a content management system. Affected versions of this package are vulnerable to Arbitrary Code Injection in the actionRenderCardPreview process. An attacker can execute arbitrary PHP code and disclose sensitive information by injecting malicious event handlers into the...

Arbitrary Code Injection

Overview org.dspace:dspace-api is a DSpace core data model and service APIs. Affected versions of this package are vulnerable to Arbitrary Code Injection through the Velocity template processing in org.dspace.core.LDN and org.dspace.core.Email. An attacker with DSpace administrator credentials ca...

Arbitrary Code Injection

Langroid is vulnerable to Arbitrary Code Injection. The vulnerability is due to improper sandboxing of Python eval that fails to remove builtins, which allows an attacker to execute arbitrary operating system commands through crafted LLM-generated tool messages...