automation-controller: automation-controller: incomplete sanitize_jinja() regex allows Jinja template injection into ad-hoc module_args, Machine-credential fields, and Host names, reaching ansible-core templating in the execution environment

A flaw was found in the automation-controller input-validation guard sanitizejinja. The function uses two regular expressions to reject user-supplied Jinja, but the patterns stop at the first interior '' or '%' character, so a Jinja expression containing an inner brace for example an empty dict i...

gitpython: GitPython: Command Injection via Git option prefix abbreviation

A flaw was found in GitPython. This vulnerability stems from an incomplete command injection blocklist that fails to account for Git's long-option prefix abbreviation feature. An attacker can bypass existing security measures by using abbreviated option names, which Git then resolves to dangerous...

gitpython: GitPython: Arbitrary code execution via command injection due to unguarded Git options

A flaw was found in GitPython where it fails to properly sanitize dangerous Git options. This vulnerability allows an attacker to inject arbitrary commands when using functions like Repo.archive and git.lsremote, potentially leading to arbitrary code execution. Additionally, functions such as...

CVE-2026-81537 DataStage on Cloud Pak for Data has several vulnerabilities

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to OS command injection...

CVE-2026-81537 DataStage on Cloud Pak for Data has several vulnerabilities

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to OS command injection...

CVE-2026-81537

IBM DataStage on Cloud Pak for Data 5.4.0.0 is susceptible to an OS command injection vulnerability. This flaw could allow a remote authenticated attacker to execute arbitrary code on the target system. No specific exploit information or remediation steps are provided in the documents, though the...

CVE-2026-80425

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...

CVE-2026-6935

IBM Concert 1.0.0 through 3.0.0 invokes operating system commands without fully qualifying executable paths or adequately restricting search path resolution. As a result, an attacker with local system access can manipulate the search path environment to execute untrusted or malicious code...

CVE-2026-80379

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...

CVE-2026-6721

IBM Concert 1.0.0 through 3.0.0 allows an unauthenticated remote attacker can supply specially crafted input that is incorporated into OS commands, resulting in arbitrary command execution on the underlying system. Successful exploitation allows remote code execution with the privileges of the...

Critical: Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update

An update is now available for Red Hat Ansible Automation Platform 2.6 Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

automation-controller: automation-controller: incomplete sanitize_jinja() regex allows Jinja template injection into ad-hoc module_args, Machine-credential fields, and Host names, reaching ansible-core templating in the execution environment

A flaw was found in the automation-controller input-validation guard sanitizejinja. The function uses two regular expressions to reject user-supplied Jinja, but the patterns stop at the first interior '' or '%' character, so a Jinja expression containing an inner brace for example an empty dict i...

gitpython: GitPython: Command Injection via Git option prefix abbreviation

A flaw was found in GitPython. This vulnerability stems from an incomplete command injection blocklist that fails to account for Git's long-option prefix abbreviation feature. An attacker can bypass existing security measures by using abbreviated option names, which Git then resolves to dangerous...

gitpython: GitPython: Arbitrary code execution via command injection due to unguarded Git options

A flaw was found in GitPython where it fails to properly sanitize dangerous Git options. This vulnerability allows an attacker to inject arbitrary commands when using functions like Repo.archive and git.lsremote, potentially leading to arbitrary code execution. Additionally, functions such as...

postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN

A flaw was found in PostgreSQL psql. During the COPY FROM STDIN operation, untrusted data can be mistakenly interpreted as psql commands if an error injection causes the command to fail prematurely. This could allow an attacker to achieve arbitrary command execution. Successful exploitation...

CVE-2026-80425 DataStage on Cloud Pak for Data has several vulnerabilities

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...

CVE-2026-80425 DataStage on Cloud Pak for Data has several vulnerabilities

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...

EUVD-2026-85673

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...

CVE-2026-80425

IBM DataStage on Cloud Pak for Data version 5.4.0.0 is vulnerable to arbitrary command execution because of the improper neutralization of special elements used in an OS command. This flaw could be exploited by a remote authenticated attacker to execute commands on the target system. No specific ...

CVE-2026-80379 DataStage on Cloud Pak for Data has several vulnerabilities

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...