WS-2017-0244

Affected versions of the package are vulnerable to Arbitrary Code Injection due to unsafe use of the eval function...

WS-2017-0223

Affected versions of the package are vulnerable to Arbitrary Code Injection due to unsafe use of the eval function...

WS-2016-0087

Hapi is vulnerable to Cross-site Scripting XSS attacks via code injection due to improperly handled invalid payloads...

WS-2017-0246

Affected versions of the package are vulnerable to Arbitrary Code Injection due to unsafe use of the eval function...

WS-2017-0240

Affected versions of the package are vulnerable to Arbitrary Code Injection due to unsafe use of the eval function...

WS-2017-0221

Affected versions of the package are vulnerable to Arbitrary Code Injection due to unsafe use of the eval function...

WS-2016-0058

Code injection vulnerability in Dustjs-linkedin through 2.5.1 allows array variables to be applied without escaping dangerous characters...

Yordam Library Automation System Code Injection Vulnerability

Yordam Library Automation System is an application developed by Yordam Corporation. Versions of Yordam Library Automation System from v.19.5 to v.22.1 had a code injection vulnerability. This vulnerability stemmed from improper control over code generation, which could allow remote code to be...

CVE-2025-15024: Improper Control of Generation of Code

Improper Control of Generation of Code 'Code Injection' vulnerability in Yordam Information Technology Consulting, Training and Electronic Systems Industry and Trade Inc. Library Automation System allows Remote Code Inclusion. This issue affects Library Automation System: from v.19.5 before v.22....

Valtimo code injection vulnerability

Valtimo is an open-source low-code platform for business process automation developed by Valtimo in the Netherlands. Versions of Valtimo from 12.0.0 to 12.32.0 contained a code injection vulnerability. This vulnerability stemmed from the use of StandardEvaluationContext to evaluate Spring...

PT-2026-41010

Name of the Vulnerable Software and Affected Versions Library Automation System versions 19.5 through 22.0 Description An improper control of code generation leads to a code injection flaw, which allows for remote code inclusion. Recommendations Update Library Automation System to version 22.1 or...

Diffusion code injection vulnerabilities

diffusers is a generative model library for generating images, audio, and 3D molecular structures, open-sourced by Hugging Face. Versions of diffusers prior to 0.38.0 contained a code injection vulnerability, which was caused by a bypass of trustremotecode, potentially allowing arbitrary remote...

Crabbox code injection vulnerability

Crabbox is an open-source remote code execution and test environment management tool developed by OpenClaw. Versions of Crabbox prior to 0.12.0 contained a code injection vulnerability. This vulnerability stemmed from a lax list of allowed environment variables, allowing attackers who access...

GitLab code injection vulnerability

GitLab is an end-to-end software development platform provided by the American company GitLab. It includes built-in features such as version control, issue tracking, code review, and CI/CD continuous integration and delivery. There were code injection vulnerabilities in versions of GitLab CE/EE...

EUVD-2026-30089

A code injection vulnerability in Palo Alto Networks Prisma® Browser on macOS fails to properly restrict access to its AppleScript interface allowing a locally authenticated non-admin user to leverage this exposed Apple Event handler to send unauthorized commands to the browser...

CVE-2026-45708 CubeCart: Authenticated RCE via Invoice Template → Order Print

CubeCart is an ecommerce software solution. Prior to 6.7.3, an admin with documents edit permission can save raw into the Invoice Editor. The next time any admin clicks Print on any order, the rendered template is written to files/print..php. files/.htaccess ships an explicit allow from all...

CVE-2026-42898

Improper control of generation of code 'code injection' in Microsoft Dynamics 365 on-premises allows an authorized attacker to execute code over a network...

CVE-2026-41094

Improper control of generation of code 'code injection' in Microsoft Data Formulator allows an unauthorized attacker to execute code over a network...

CVE-2026-0236

A code injection vulnerability in Palo Alto Networks Prisma® Browser on macOS fails to properly restrict access to its AppleScript interface allowing a locally authenticated non-admin user to leverage this exposed Apple Event handler to send unauthorized commands to the browser...

Arbitrary Code Injection

Overview vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Affected versions of this package are vulnerable to Arbitrary Code Injection through the yield iterator inside an async generator. An attacker can execute arbitrary commands on the host system by...