CVE-2017-9779

WindowsのPath Usersによるペイロードの自動実行 :: Cmderとは？ Cmderは、Windowsに優れたコンソールエミュレータがないことへの純粋なフラストレーションから作成されたソフトウェアパッケージです。素晴らしいソフトウェアをベースに、Monokaiカラースキームとカスタムプロンプトレイアウトでスパイスを加え、最初からセクシーに見えます。 Cmderのサイトフレームワーク！ http://cmder.net/ .bashrcとは？ 実行可能ファイルであり、記述した任意の単語が直接ターミナルに表示されます。残念ながら、すべてのLinuxシステムで動作します。...

git-fsmonitor

これは文書化された（既知の）問題ですが、私のリサーチ中に見つけたもので、RT/PTに非常に役立ちます。 概要: FSMonitorヘルパーは、git status、git diff など、すべてのgitコマンドで git によって実行されるため、git は指定されたパスを盲目的に起動します。IDEはフォルダを開いた瞬間に自動的に git status を実行し、SCM（ソース管理）パネルを設定します。これにより、git が設定されたヘルパーを起動し、攻撃者が制御するコードが実行されます。このトレードクラフトは、RT中や侵害を想定したシナリオで、任意のC2や当社の XRayC2...

memory-poisoning-axis

memory-poisoning-axis 确定性内存投毒 / 提示注入测量 —— 锚定于 CVE-2026-24301 "CoSnitch"（Microsoft Copilot Personal，CVSS 3.1 8.8，于 2026 年 8 月 18 日修补）。 CoSnitch 链式组合了：i 自动提示执行（?q= + 未记录的 ?autorun=1），ii 通过 URL-fetch 从已连接的 Gmail/Drive/Calendar 中拉取数据以实现数据外泄，以及 iii 能够经受 密码修改、会话撤销和设备重新注册的持久性内存投毒 。本包 使用确定性谓词测量阶段 iii ——...

MAL-2026-14533 Malicious code in chai-plus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b91b222013b099c570003ced5265988a19121921b071ee183cdbe304e2b020d9 On require'chai-plus', a top-level IIFE in lib/index.js unconditionally invokes Bootstrap.execute, which spawns npm install -g [email protected] an...

Malicious code in chai-plus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b91b222013b099c570003ced5265988a19121921b071ee183cdbe304e2b020d9 On require'chai-plus', a top-level IIFE in lib/index.js unconditionally invokes Bootstrap.execute, which spawns npm install -g [email protected] an...

MAL-2026-13559 Malicious code in dolyame-ui-collapseblock (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ef9992e81f3de4cb9bd4391466d7850e953c19a0772ebbe5992953044466377c On require, shim.js fetches an OS/architecture-specific native binary from hardcoded Cloudflare Workers hosts oob-worker.cf100-416.workers.dev,...

Malicious code in tinkoff-pfp-atom-styles-tiles (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 471d141c15ae867da45bf9c0f0802fa3c690c545184df894b96f1fcf61792c35 index.js unconditionally requires./ext inside a swallowed try/catch. ext.js is a platform-aware dropper: it constructs Cloudflare workers.dev hostnam...

paseo-poc-repo-trust

paseo-poc-repo-trust — DEMO PoC repository ⚠️ This is a sec...

MAL-2026-10755 Malicious code in captcha-solve-api (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 99621af0900df34246c87811ea5c2a643f2b3805601136dcc0a6768e48af925f The PyPI package captcha-solve-api contains no captcha functionality and is instead a binary dropper disguised as an analytics SDK. A custom setuptoo...

Malicious code in @equansservices/tool (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7bb693b5ae7f1fccb6c2aaa1a5f9225b23fb7ece3928feca604f2c5139ee5198 The package's postinstall hook node setup.js fetches a platform-specific payload from http://d2vf4rs175cy2k.cloudfront.net/install/v1/plugin.zip over...

PT-2026-45768

Name of the Vulnerable Software and Affected Versions Amazon Kiro IDE versions prior to 0.11 Description Insufficient access control restrictions in the file write tool allow remote unauthenticated actors to execute arbitrary commands. This is achieved by using crafted instructions to write to...

CVE-2026-45311

The CVE concerns the DeepSeek-TUI run_tests tool, where versions 0.3.0–0.8.23 auto-run cargo test without user approval, enabling execution of arbitrary code via test code and build scripts. The root cause is that tests are auto-approved, allowing attacker-controlled test code in a malicious repo...

MAL-2026-4475 Malicious code in aes-decode-runner-pro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a84e76208311859e852fea114c26e1eff1202eeff9a463707c5ae0deec68725c aes-decode-runner-pro ships an opaque 326-byte AES-GCM ciphertext DEFAULTFINALENCODEDTEXT in src/config/defaults.js along with a hardcoded passphrase...

MAL-2026-2529 Malicious code in use-form-builder-plugin (npm)

Package is malware. Collects system info, exfiltrates data via HTTP/DNS, executes commands, and uses preinstall script for auto-execution. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bdced38cb2f5f34bb91f39b16697369424bf1cbde84ca18363e78454b31d6ddc The packag...

CVE-2026-30309

InfCode's terminal auto-execution module contains a critical command filtering vulnerability that renders its blacklist security mechanism completely ineffective. The predefined blocklist fails to cover native high-risk commands in Windows PowerShell such as powershell, and the matching algorithm...

PT-2026-29252

InfCode's terminal auto-execution module contains a critical command filtering vulnerability that renders its blacklist security mechanism completely ineffective. The predefined blocklist fails to cover native high-risk commands in Windows PowerShell such as powershell, and the matching algorithm...

CVE-2026-28674 xiaoheiFS Vulnerable to RCE via Arbitrary Payment Plugin Upload (Automatic Execution)

xiaoheiFS is a self-hosted financial and operational system for cloud service businesses. In versions up to and including 0.3.15, the AdminPaymentPluginUpload endpoint lets admins upload any file to plugins/payment/. It only checks a hardcoded password qweasd123456 and ignores file content. A...

PT-2026-25971

xiaoheiFS is a self-hosted financial and operational system for cloud service businesses. In versions up to and including 0.3.15, the AdminPaymentPluginUpload endpoint lets admins upload any file to plugins/payment/. It only checks a hardcoded password qweasd123456 and ignores file content. A...

CVE-2026-31854

Cursor is a code editor built for programming with AI. Prior to 2.0 ,if a visited website contains maliciously crafted instructions, the model may attempt to follow them in order to “assist” the user. When combined with a bypass of the command whitelist mechanism, such indirect prompt injections...

EUVD-2026-11245

Cursor is a code editor built for programming with AI. Prior to 2.0 ,if a visited website contains maliciously crafted instructions, the model may attempt to follow them in order to “assist” the user. When combined with a bypass of the command whitelist mechanism, such indirect prompt injections...