@nx/docker: OS command injection in the @nx/docker release pipeline

Summary The @nx/docker release pipeline builds its docker invocations as shell command strings, interpolating release.docker.repositoryName and registryUrl from Nx configuration into them. Because those strings are handed to /bin/sh -c, a crafted repository or registry name executes as a command...

GHSA-6VC5-VF29-FFR2 @nx/docker: OS command injection in the @nx/docker release pipeline

Summary The @nx/docker release pipeline builds its docker invocations as shell command strings, interpolating release.docker.repositoryName and registryUrl from Nx configuration into them. Because those strings are handed to /bin/sh -c, a crafted repository or registry name executes as a command...

Nx: OS command injection via git revisions and remote refs

Summary Nx core builds several git invocations as shell command strings with untrusted values interpolated into them, so a value that should be a git revision or ref is parsed by /bin/sh instead. Two entry points are reachable by an attacker: affected commands, where defaultBase /...

NPM: Nx: OS command injection via git revisions and remote refs

NPM: Nx: OS command injection via git revisions and remote refs vulnerability discovered by ? in WordPress Npm nx versions = 14.0.0, 22.7.8...

GHSA-W2VW-W76X-QR89 Nx: OS command injection via git revisions and remote refs

Summary Nx core builds several git invocations as shell command strings with untrusted values interpolated into them, so a value that should be a git revision or ref is parsed by /bin/sh instead. Two entry points are reachable by an attacker: affected commands, where defaultBase /...

Centreon-20.04

CVE-2020-12688 - Аутентифицированное удаленное выполнение кода Centreon 20.04 Переменная имени команды в minHelpCommand.php RCE CVE-2020-12688 Документация последнего релиза Centreon: https://docs.centreon.com/current/en/releases/centreon-core.html Обнаружено: TheCyberGeek Дата обнаружения:...

CVE-2025-69212_PoC

CVE-2025-69212: إثبات المفهوم PoC لـ OpenSTAManager يحتوي هذا المستودع على إثبات مفهوم PoC يوضح الثغرة الأمنية المعروفة باسم CVE-2025-69212 في OpenSTAManager، وهي ثغرة حقن أوامر نظام التشغيل ناتجة عن وظيفة فك تشفير ملفات P7M XML الموقعة. الإصدارات المتأثرة هي 2.9.8 وما قبله. الوصف CVE-2025-69212 ...

VulnerableSpringDataRest

تطبيق Spring DataRest القابل للثغرات هذا تطبيق Spring Data REST مُعدّ عمدًا لاختبار وإظهار ثغرة CVE-2017-8046 وتحديات اختبار حقن الأوامر وتنفيذ التعليمات البرمجية عن بُعد عبر REST APIs يدعم واجهة Swagger UI لاستخدامها مع الأدوات التي تساعد فيها توثيقات Swagger على الاكتشاف والزحف، مثل إضافة OWASP...

CVE-2026-9277

CVE-2026-9277 - استغلال حقن الأوامر في Shell-Quote سكربت استغلال متخصص من نوع إثبات المفهوم PoC مصمم للتحقق من CVE-2026-9277 وإثباته — وهي ثغرة حقن أوامر بنيوية Command Injection موجودة في الإصدارات القديمة من مكتبة shell-quote = 1.8.3. يقوم الماسح بتلاعب بنيوي عميق في حمولات JSON المُدخلة لكشف...

codeql-workshop

البحث عن الثغرات باستخدام CodeQL ورشة عمل أصلية من Sylwia Budzynska المتطلبات الأساسية • الموارد • ورشة العمل لمن هذا : مهندسو الأمن، باحثو الأمن، المطورون. ماذا ستتعلم : تعلم كيفية استخدام CodeQL لاستكشاف الأكواد وإيجاد المشكلات الأمنية. ماذا ستبني : بناء استعلام CodeQL بناءً على توصية أمنية...

Hack-The-Box-Enigma-Findings-Report

🛡️ Hack The Box - Rapport des découvertes Enigma 📋 Aperçu Ce dépôt contient un rapport complet de test d'intrusion pour la machine Enigma de Hack The Box. 🔍 Découvertes clés Partage NFS non sécurisé exposant des documents d'intégration - Sévérité moyenne Divulgation de justificatifs internes via u...

CVE-2026-105767

Improper Neutralization of Special Elements used in an OS Command in the integrate-platform-docs composite GitHub Action of Chainguard Academy edu from commit 7375a80caabcc31c33ec90f29687ed78c13d16ff before commit fb0efb2537d326ab18c07d620875b8ed2a4b39f3 allows an actor who controls the projectid...

CVE-2026-105691

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the SVG exporter places an attacker-controlled text object's fill-color value into a ppmcolormask command string and executes that string through childprocess.exec. A user who can edit a file can store shell metacharacters...

CVE-2026-105697 Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration

Langflow is a tool for building and deploying AI-powered agents and workflows. Before Langflow 1.10.3, the MCP stdio transport launched whatever command / args a user put in an MCP server configuration, with no allowlist and before 1.10.3 wrapped in bash -c "exec command ...". Any user able to...

CVE-2026-105697 Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration

Langflow is a tool for building and deploying AI-powered agents and workflows. Before Langflow 1.10.3, the MCP stdio transport launched whatever command / args a user put in an MCP server configuration, with no allowlist and before 1.10.3 wrapped in bash -c "exec command ...". Any user able to...

CVE-2026-105697 Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration

Langflow is a tool for building and deploying AI-powered agents and workflows. Before Langflow 1.10.3, the MCP stdio transport launched whatever command / args a user put in an MCP server configuration, with no allowlist and before 1.10.3 wrapped in bash -c "exec command ...". Any user able to...

CVE-2026-105697

Langflow versions prior to 1.10.3 are vulnerable to OS command injection due to a lack of allowlisting in the MCP stdio transport configuration. An attacker capable of accessing MCP server settings or using the MCP Tools component can execute arbitrary OS commands (e.g., rm -rf, reverse shells) o...

CVE-2026-105691 Penpot: Authenticated OS Command Injection in Penpot SVG Exporter via Legacy fill-color

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the SVG exporter places an attacker-controlled text object's fill-color value into a ppmcolormask command string and executes that string through childprocess.exec. A user who can edit a file can store shell metacharacters...

CVE-2026-105691 Penpot: Authenticated OS Command Injection in Penpot SVG Exporter via Legacy fill-color

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the SVG exporter places an attacker-controlled text object's fill-color value into a ppmcolormask command string and executes that string through childprocess.exec. A user who can edit a file can store shell metacharacters...

CVE-2026-105691

The open-source design platform Penpot contains an OS Command Injection vulnerability in its SVG exporter affecting versions prior to 2.18.0 . The root cause is the unsafely handling of an attacker-controlled fill-color value from a text object, which is placed into a ppmcolormask command string ...