awesome-cybersecurity-resources

awesome-cybersecurity-resources Awesome Cybersecurity Resources, more. Purpose This repository stores curated cybersecurity resources gathered from the internet, repository documentation, and selected local notes. The canonical format is: one resource per Markdown file YAML frontmatter as the...

obsidian-note-toolbar-PoC

Frontmatter-Driven Arbitrary Code Execution in Note Toolbar via propNAME → js: Variable Chain CVE status: requested, pending assignment. This finding is published as GHSA-q8cw-3m8c-5pf2. On CVE assignment this repository is renamed CVE-YYYY-NNNNN-obsidian-note-toolbar-PoC and this banner is...

org.webjars.npm:remark-mdx-frontmatter (5.1.0), org.webjars.npm:snyk-go-plugin (1.5.2) potentially affected by CVE-2026-77465 via org.webjars.npm:toml (>=2.3.3, <=3.0.0)

org.webjars.npm:toml MAVEN version =2.3.3, =3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:toml and may be impacted: - org.webjars.npm:remark-mdx-frontmatter 5.1.0 - org.webjars.npm:snyk-go-plugin 1.5.2 Source cves: CVE-2026-7746...

EUVD-2026-62549

Grav: Remote code execution via unrestricted callable in Blueprint::dynamicData...

Arbitrary Code Injection

Overview getgrav/grav is a Modern, Crazy Fast, Ridiculously Easy and Amazingly Powerful Flat-File CMS. Affected versions of this package are vulnerable to Arbitrary Code Injection via the dynamicData function. An attacker can execute arbitrary code by supplying a crafted callback and arguments,...

CVE-2026-64850

In Grav prior to 2.0.7, Blueprint::dynamicData() in system/src/Grav/Common/Data/Blueprint.php passes an editor-controlled callable to call_user_func_array() without filtering dangerous callbacks. A user with admin.pages or api.pages.write privileges can use arrayFilterRecursive() as a trampoline ...

CVE-2026-64850 Grav: Remote code execution via unrestricted callable in Blueprint::dynamicData()

Grav is a file-based Web platform. Prior to 2.0.7, Grav Blueprint::dynamicData in system/src/Grav/Common/Data/Blueprint.php sends an editor-controlled Class::method provider and arguments to calluserfuncarray without rejecting dangerous callback parameters. An account with admin.pages or...

Arbitrary Code Injection

Overview getgrav/grav is a Modern, Crazy Fast, Ridiculously Easy and Amazingly Powerful Flat-File CMS. Affected versions of this package are vulnerable to Arbitrary Code Injection via the Blueprint::isSafeDynamicCall process. An attacker can execute arbitrary public static PHP methods with...

Arbitrary Code Injection

Overview getgrav/grav is a Modern, Crazy Fast, Ridiculously Easy and Amazingly Powerful Flat-File CMS. Affected versions of this package are vulnerable to Arbitrary Code Injection via the dynamicData function. An attacker can execute arbitrary code by planting a malicious callable directive in a...

CVE-2026-65008

Grav 2.0.4 contains a remote code execution vulnerability in Blueprint::dynamicData(), where a Class::method callable string and arguments are passed to call_user_func_array() without an allowlist. The form plugin routes page frontmatter through this path, allowing an authenticated user with admi...

PT-2026-61930

Name of the Vulnerable Software and Affected Versions Grav versions 2.0.4 through 2.0.6 Description Remote code execution is possible through the Blueprint::dynamicData function in the system/src/Grav/Common/Data/Blueprint.php file. The issue occurs because a Class::method callable string and its...

Code Injection

@prompty/core is vulnerable to Code Injection. The vulnerability is due to the use of gray-matter with executable JavaScript frontmatter enabled, which allows an attacker to execute arbitrary JavaScript by supplying a malicious .prompty file...

GHSA-C4GH-RV8H-Q9VW Prompty: Arbitrary code execution via JavaScript frontmatter in TypeScript loader

Summary The TypeScript Prompty loader used gray-matter without overriding executable frontmatter engines. gray-matter supports JavaScript frontmatter blocks such as ---js and evaluates them while parsing. An attacker-controlled .prompty file could therefore execute arbitrary JavaScript during...

Prompty: Arbitrary code execution via JavaScript frontmatter in TypeScript loader

Summary The TypeScript Prompty loader used gray-matter without overriding executable frontmatter engines. gray-matter supports JavaScript frontmatter blocks such as ---js and evaluates them while parsing. An attacker-controlled .prompty file could therefore execute arbitrary JavaScript during...

EUVD-2026-44939

Prompty: Arbitrary code execution via JavaScript frontmatter in TypeScript loader...

EUVD-2026-44940

Prompty: Arbitrary file read via file reference expansion...

CVE-2026-53597

Prompty is a markdown file format .prompty for LLM prompts. From 2.0.0-alpha.1 until 2.0.0-beta.3, the @prompty/core TypeScript loader in runtime/typescript/packages/core/src/core/loader.ts used gray-matter without overriding executable js and javascript frontmatter engines, allowing an...

CVE-2026-53598

Prompty is a markdown file format .prompty for LLM prompts. Prior to 2.0.0-beta.2, Prompty loaders expanded $file:... references in .prompty frontmatter without enforcing that resolved paths stayed within the prompt directory or allowed roots, allowing an attacker-controlled prompt file to read...

CVE-2026-53598 Prompty: Arbitrary File Read via ${file:path} Reference Expansion

Prompty is a markdown file format .prompty for LLM prompts. Prior to 2.0.0-beta.2, Prompty loaders expanded $file:... references in .prompty frontmatter without enforcing that resolved paths stayed within the prompt directory or allowed roots, allowing an attacker-controlled prompt file to read...

CVE-2026-53598 Prompty: Arbitrary File Read via ${file:path} Reference Expansion

Prompty is a markdown file format .prompty for LLM prompts. Prior to 2.0.0-beta.2, Prompty loaders expanded $file:... references in .prompty frontmatter without enforcing that resolved paths stayed within the prompt directory or allowed roots, allowing an attacker-controlled prompt file to read...