CVE-2025-52386: Improper Neutralization of Formula Elements in a CSV File

CycloneDX Sunshine v0.9 is vulnerable to CSV Formula Injection via a crafted JSON file...

CVE-2025-52386

The open-source visualization tool CycloneDX Sunshine version v0.9 is vulnerable to CSV Formula Injection (CWE-1236). The root cause is the software's failure to validate formulas when processing crafted JSON files . This vulnerability can lead to malicious code execution or data exfiltration whe...

Formula-Injection-in-CycloneDX-Sunshine

It is an offensive tool for CycloneDX. Exploit module/toolkit ta...

CVE-2024-50611

CycloneDX cdxgen through 10.10.7, when run against an untrusted codebase, may execute code contained within build-related files such as build.gradle.kts, a similar issue to CVE-2022-24441. cdxgen is used by, for example, OWASP dep-scan. NOTE: this has been characterized as a design limitation,...

Malicious code in cargo-cyclonedx (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 310e72b56f73cd7a869e3c76fc0da1be55d3e187c73cca623ce18ea3107f992c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2568 Malicious code in cargo-cyclonedx (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 310e72b56f73cd7a869e3c76fc0da1be55d3e187c73cca623ce18ea3107f992c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-34345

The CycloneDX JavaScript library contains the core functionality of OWASP CycloneDX for JavaScript. In 6.7.0, XML External entity injections were possible, when running the provided XML Validator on arbitrary input. This issue was fixed in version 6.7.1...

conan-app-launcher (>=2.0.0b1, <=2.2.0), conan-explorer (>=2.2.0a2, <=2.3.1) +6 more potentially affected by unknown CVE via conan (>=2.0.0b10, <=2.8.1)

conan PYPI version =2.0.0b10, =2.0.0b1, =2.2.0a2, =0.1.0a1, =0.5.2, =1.3.2, =0.0.1, =2.0.0, =3.2.3 Source cves: unknown CVE Source advisory: SNYK:PYTHON-CONAN-8400482...

CycloneDX cdxgen may execute code contained within build-related files

CycloneDX cdxgen prior to 11.1.7, when run against an untrusted codebase, may execute code contained within build-related files such as build.gradle.kts, a similar issue to CVE-2022-24441. cdxgen is used by, for example, OWASP dep-scan. NOTE: this has been characterized as a design limitation,...

GHSA-HXF3-VGPM-FV9P CycloneDX cdxgen may execute code contained within build-related files

CycloneDX cdxgen prior to 11.1.7, when run against an untrusted codebase, may execute code contained within build-related files such as build.gradle.kts, a similar issue to CVE-2022-24441. cdxgen is used by, for example, OWASP dep-scan. NOTE: this has been characterized as a design limitation,...

CVE-2024-50611

CycloneDX cdxgen through 10.10.7, when run against an untrusted codebase, may execute code contained within build-related files such as build.gradle.kts, a similar issue to CVE-2022-24441. cdxgen is used by, for example, OWASP dep-scan. NOTE: this has been characterized as a design limitation,...

CVE-2024-50611

CycloneDX cdxgen through 10.10.7, when run against an untrusted codebase, may execute code contained within build-related files such as build.gradle.kts, a similar issue to CVE-2022-24441. cdxgen is used by, for example, OWASP dep-scan. NOTE: this has been characterized as a design limitation,...

CVE-2024-50611

CycloneDX cdxgen through 10.10.7, when run against an untrusted codebase, may execute code contained within build-related files such as build.gradle.kts, a similar issue to CVE-2022-24441. cdxgen is used by, for example, OWASP dep-scan. NOTE: this has been characterized as a design limitation,...

PT-2024-34357 · Node.Js +3 · Node.Js +3

Name of the Vulnerable Software and Affected Versions: CycloneDX cdxgen versions prior to 11.1.7 Description: The issue allows execution of code contained within build-related files, such as build.gradle.kts, when run against an untrusted codebase. This is similar to a previously identified issue...

@socketsecurity/cli (>=0.10.0, <=0.11.1) potentially affected by CVE-2024-50611 via @cyclonedx/cdxgen (10.11.0)

@cyclonedx/cdxgen NPM version 10.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on @cyclonedx/cdxgen and may be impacted: - @socketsecurity/cli =0.10.0, =0.11.1 Source cves: CVE-2024-50611 Source advisory: MEND:CVE-2024-50611...

CVE-2024-50611: Improper Control of Generation of Code

CycloneDX cdxgen through 10.10.7, when run against an untrusted codebase, may execute code contained within build-related files such as build.gradle.kts, a similar issue to CVE-2022-24441. cdxgen is used by, for example, OWASP dep-scan. NOTE: this has been characterized as a design limitation,...

CycloneDX Generator security vulnerability

CycloneDX Generator cdxgen is a CLI tool, library, REPL and server for CycloneDX open source. It is used to create valid and compatible CycloneDX bill of materials. A security vulnerability exists in CycloneDX Generator version 10.10.7 and prior versions, which stems from the possibility of...

CVE-2024-50611

CycloneDX cdxgen through 10.10.7, when run against an untrusted codebase, may execute code contained within build-related files such as build.gradle.kts, a similar issue to CVE-2022-24441. cdxgen is used by, for example, OWASP dep-scan. NOTE: this has been characterized as a design limitation,...

CVE-2024-50611

CycloneDX cdxgen through 10.10.7, when run against an untrusted codebase, may execute code contained within build-related files such as build.gradle.kts, a similar issue to CVE-2022-24441. cdxgen is used by, for example, OWASP dep-scan. NOTE: this has been characterized as a design limitation,...

CVE-2024-50611

The CycloneDX cdxgen tool (prior to version 11.1.7 ) is vulnerable to Arbitrary Code Execution (ACE) when processing an untrusted codebase. The root cause is a design limitation where the tool lacks safeguards against executing code contained within build-related files, such as build.gradle.kts. ...