fastgpt-sandbox-audit

fastgpt-sandbox-audit FastGPT Python 샌드박스 탈출 체인 감사 도구. FastGPT 워크플로의 "코드 실행" 노드는 사용자 Python 코드를 독립 샌드박스에 전달하여 실행합니다. v4.14.8의 샌드박스 보호는 순수 Python 계층모듈 블랙리스트 + AST 검사 + open 가드 + import 가드이며, 본 도구는 이러한 보호의 우회 체인을 탐지하고 검증합니다: root@kitploit: import inspect inspect 不在 DANGEROUSSTDLIB 黑名单 g =...

CVE-2026-5029-Exploit

🔥 CVE-2026-5029 — RCE в Code Runner MCP Server Удалённое выполнение кода без аутентификации через MCP-инструмент run-code PoC-эксплойт для CVE-2026-5029 — критическая уязвимость удалённого выполнения кода без аутентификации в Code Runner MCP Server, срабатывающая через MCP-инструмент при запуске...

CVE-2026-5029

A remote code execution vulnerability exists in Code Runner MCP Server when run with the --transport http option, which exposes the /mcp JSON-RPC endpoint without authentication on port 3088. An unauthenticated remote attacker can invoke the run-code MCP tool to supply arbitrary source code and...

EUVD-2026-29437

A remote code execution vulnerability exists in Code Runner MCP Server when run with the --transport http option, which exposes the /mcp JSON-RPC endpoint without authentication on port 3088. An unauthenticated remote attacker can invoke the run-code MCP tool to supply arbitrary source code and...

CVE-2026-5029

A remote code execution vulnerability exists in Code Runner MCP Server when run with the --transport http option, which exposes the /mcp JSON-RPC endpoint without authentication on port 3088. An unauthenticated remote attacker can invoke the run-code MCP tool to supply arbitrary source code and...

CVE-2026-5029 RCE in Code Runner MCP Server

A remote code execution vulnerability exists in Code Runner MCP Server when run with the --transport http option, which exposes the /mcp JSON-RPC endpoint without authentication on port 3088. An unauthenticated remote attacker can invoke the run-code MCP tool to supply arbitrary source code and...

CVE-2026-5029

CVE-2026-5029 affects Code Runner MCP Server when run with --transport http, exposing the /mcp JSON-RPC endpoint on port 3088 without authentication. An unauthenticated attacker can invoke the run-code MCP tool to supply arbitrary source code and execute it via child_process.exec() using the spec...

CVE-2026-5029 RCE in Code Runner MCP Server

A remote code execution vulnerability exists in Code Runner MCP Server when run with the --transport http option, which exposes the /mcp JSON-RPC endpoint without authentication on port 3088. An unauthenticated remote attacker can invoke the run-code MCP tool to supply arbitrary source code and...

Code Runner MCP Server 访问控制错误漏洞

Code Runner MCP Server is a multi-language code execution and result display tool developed by Jun Han. There is an access control vulnerability in Code Runner MCP Server. This vulnerability arises when the --transport http option is used, exposing an unauthenticated /mcp JSON-RPC endpoint on por...

PT-2026-39994

A remote code execution vulnerability exists in Code Runner MCP Server when run with the --transport http option, which exposes the /mcp JSON-RPC endpoint without authentication on port 3088. An unauthenticated remote attacker can invoke the run-code MCP tool to supply arbitrary source code and...

Critical Flaws Found in Four VS Code Extensions with Over 125 Million Installs

Cybersecurity researchers have disclosed multiple security vulnerabilities in four popular Microsoft Visual Studio Code VS Code extensions that, if successfully exploited, could allow threat actors to steal local files and execute code remotely. The extensions, which have been collectively...

CVE-2025-65715

An issue in the code-runner.executorMap setting of Visual Studio Code Extensions Code Runner v0.12.2 allows attackers to execute arbitrary code when opening a crafted workspace...

CVE-2025-65715

An issue in the code-runner.executorMap setting of Visual Studio Code Extensions Code Runner v0.12.2 allows attackers to execute arbitrary code when opening a crafted workspace...

CVE-2025-65715

An issue in the code-runner.executorMap setting of Visual Studio Code Extensions Code Runner v0.12.2 allows attackers to execute arbitrary code when opening a crafted workspace...

PT-2026-8354

Name of the Vulnerable Software and Affected Versions Code Runner versions prior to 0.12.2 Description A flaw exists in the code-runner.executorMap setting of the Code Runner extension for Visual Studio Code. This allows for the execution of arbitrary code when a specially crafted workspace is...

CVE-2025-65715

The CVE-2025-65715 entry affects the Visual Studio Code extension Code Runner (v0.12.2). The vulnerability lies in the code-runner.executorMap setting, which can be manipulated to cause arbitrary code execution when a crafted workspace is opened. Evidence from multiple sources confirms this vulne...

Code Runner 安全漏洞

Code Runner is a code execution tool developed by Jun Han. Version 0.12.2 of Code Runner has a security vulnerability, which stems from an issue with the code-runner.executorMap setting. This vulnerability could allow for the execution of arbitrary code...

CVE-2025-65715

An issue in the code-runner.executorMap setting of Visual Studio Code Extensions Code Runner v0.12.2 allows attackers to execute arbitrary code when opening a crafted workspace...

CVE-2025-65715

An issue in the code-runner.executorMap setting of Visual Studio Code Extensions Code Runner v0.12.2 allows attackers to execute arbitrary code when opening a crafted workspace...

CVE-2025-65715

An issue in the code-runner.executorMap setting of Visual Studio Code Extensions Code Runner v0.12.2 allows attackers to execute arbitrary code when opening a crafted workspace...