MSC-2026-11522

Active npm supply chain compromise of @7nohe/openapi-react-query-codegen 150,000 weekly downloads, linked to the ongoing Mini Shai-Hulud campaign. An unprotected GitHub Actions release workflow let any account publish fork contents under the repository's trusted-publishing identity, producing ten...

Malware in @7nohe/openapi-react-query-codegen

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in @7nohe/openapi-react-query-codegen (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ab8f8efdad9084d2a7c5ae5058ffc18886d68bfe1c676239fd7e0d41342fc700 The tarball ships a binding.gyp at the package root whose conditions field abuses GYP's Python expression evaluator to walk .class.base.subclasses to...

MAL-2026-15494 Malicious code in @7nohe/openapi-react-query-codegen (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ab8f8efdad9084d2a7c5ae5058ffc18886d68bfe1c676239fd7e0d41342fc700 The tarball ships a binding.gyp at the package root whose conditions field abuses GYP's Python expression evaluator to walk .class.base.subclasses to...

Embedded Malicious Code

Overview @7nohe/openapi-react-query-codegen is an OpenAPI React Query Codegen Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a destructive worm and credential harvester. A malicious actor exploited a comment-triggered GitHub Actions workflow by commentin...

absolut (0.1.1), absolut-core (0.1.0) +23 more potentially affected by unknown CVE via z3 (>=0.4.0, <=0.20.2)

z3 CARGO version =0.4.0, =0.4.0, =0.13.0, =0.64.0, =0.2.1, =0.1.0, =0.6.0, =0.1.0, =0.1.1 - logicaffeine-proof 0.11.0 - logicaffeine-verify 0.11.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0295...

Malicious code in eth-codegen (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c111948c855e4133fbd037c268523a2118038ca498e9bdba1c743d4ee77f24bc The package advertises itself as an Ethereum codegen utility but its actual contents are an unrelated mongoose leanhooks plugin plus a hidden dropper...

MAL-2026-12371 Malicious code in eth-codegen (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c111948c855e4133fbd037c268523a2118038ca498e9bdba1c743d4ee77f24bc The package advertises itself as an Ethereum codegen utility but its actual contents are an unrelated mongoose leanhooks plugin plus a hidden dropper...

Arbitrary Code Injection

Overview @aws-amplify/codegen-ui-react is an Amplify UI React code generation implementation Affected versions of this package are vulnerable to Arbitrary Code Injection through the ReactThemeStudioTemplateRenderer in packages/codegen-ui-react/lib/react-theme-studio-template-renderer.ts. An...

CVE-2026-18245

Improper control of code generation in Amazon @aws-amplify/codegen-ui-react before 2.20.6 might allow a remote authenticated user to execute arbitrary code in end-user browsers, developer machines, CI/CD environments, and server-side rendering contexts via crafted Studio component or theme schema...

EUVD-2026-51268

Improper control of code generation in Amazon @aws-amplify/codegen-ui-react before 2.20.6 might allow a remote authenticated user to execute arbitrary code in end-user browsers, developer machines, CI/CD environments, and server-side rendering contexts via crafted Studio component or theme schema...

CVE-2026-18245 Incomplete fix for CVE-2025-4318 code injection in Amazon @aws-amplify/codegen-ui-react

Improper control of code generation in Amazon @aws-amplify/codegen-ui-react before 2.20.6 might allow a remote authenticated user to execute arbitrary code in end-user browsers, developer machines, CI/CD environments, and server-side rendering contexts via crafted Studio component or theme schema...

CVE-2026-18245 Incomplete fix for CVE-2025-4318 code injection in Amazon @aws-amplify/codegen-ui-react

Improper control of code generation in Amazon @aws-amplify/codegen-ui-react before 2.20.6 might allow a remote authenticated user to execute arbitrary code in end-user browsers, developer machines, CI/CD environments, and server-side rendering contexts via crafted Studio component or theme schema...

CVE-2026-18245

Improper control of code generation in Amazon @aws-amplify/codegen-ui-react before 2.20.6 might allow a remote authenticated user to execute arbitrary code in end-user browsers, developer machines, CI/CD environments, and server-side rendering contexts via crafted Studio component or theme schema...

CVE-2026-18245

Improper control of code generation in Amazon @aws-amplify/codegen-ui-react before 2.20.6 might allow a remote authenticated user to execute arbitrary code in end-user browsers, developer machines, CI/CD environments, and server-side rendering contexts via crafted Studio component or theme schema...

CVE-2026-18245: Improper Control of Generation of Code

Improper control of code generation in Amazon @aws-amplify/codegen-ui-react before 2.20.6 might allow a remote authenticated user to execute arbitrary code in end-user browsers, developer machines, CI/CD environments, and server-side rendering contexts via crafted Studio component or theme schema...

GO-2026-6016 oapi-codegen: OpenAPI Server Description Escapes Generated Go Comment and Injects Executable Code in github.com/oapi-codegen/oapi-codegen

oapi-codegen: OpenAPI Server Description Escapes Generated Go Comment and Injects Executable Code in github.com/oapi-codegen/oapi-codegen...

com.primust:primust-cedar (>=1.0.2, <=1.0.3), io.github.devnico:cedar4s-client_2.13 (>=0.1.0, <=0.1.6) +12 more potentially affected by CVE-2026-55771 via com.cedarpolicy:cedar-java (>=4.3.0, <=4.8.0)

com.cedarpolicy:cedar-java MAVEN version =4.3.0, =1.0.2, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.6 Source cves: CVE-2026-55771 Source advisory: MEND:CVE-2026-55771...

CVE-2026-15512

A vulnerability was identified in pig-mesh Pig up to 3.9.2. Affected by this issue is some unknown functionality of the file \pig-master\pig-visual\pig-codegen\src\main\java\com\pig4cloud\pig\codegen\service\impl\GeneratorServiceImpl.java of the component pig-codegen. Such manipulation leads to...

CVE-2026-15512: Improper Control of Generation of Code

A vulnerability was identified in pig-mesh Pig up to 3.9.2. Affected by this issue is some unknown functionality of the file \pig-master\pig-visual\pig-codegen\src\main\java\com\pig4cloud\pig\codegen\service\impl\GeneratorServiceImpl.java of the component pig-codegen. Such manipulation leads to...