EUVD-2026-84941

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to execute arbitrary code due to improper neutralization of user-controlled input within the new Function constructor...

CVE-2026-18162

The IBM Financial Transaction Manager (FTM) for RedHat OpenShift is impacted by a vulnerability that could allow a remote attacker to execute arbitrary code . The root cause is the improper neutralization of user-controlled input within the new Function constructor . The vulnerability has a CRITI...

CVE-2025-58434-59528

CVE-2025-58434 + CVE-2025-59528 Exploit chain for two vulnerabilities affecting Flowise = 3.0.5. Vulnerabilities CVE-2025-58434 — Unauthenticated Account Takeover The forgot-password endpoint returns a valid password reset token in the API response without requiring authentication. An attacker wi...

CVE-2026-40897

CVE-2026-40897 Remote Code Execution in Math.js Expression Parser ★ CVE-2026-40897 Remote Code Execution in Math.js PoC ★ https://github.com/user-attachments/assets/8c394039-f00a-4875-991a-fb5f40bc6898 Overview CVE-2026-40897 is a Sandbox Bypass leading to Remote Code Execution vulnerability in...

React2Shell-CVE-2025-55182-The-Deserialization-Bug-That-Broke-the-Web

React2Shell CVE-2025-55182: The Deserialization Bug That Broke the Web ⚡ React2Shell, CVE-2025-55182, RCE Vulnerability: A critical breakdown of the unsafe deserialization flaw in React Server Components that enables unauthenticated remote code execution across default React/Next.js setups. ⏩ TL;...

CVE-2026-93985

OpenPanel js-runtime through commit bad75bdd is affected by a sandbox escape in its JavaScript webhook template validator . The validator fails to block computed member access to constructor chains, allowing attackers with project write access to craft webhook templates using computed property no...

CVE-2026-41242

CVE-2026-41242 — protobuf.js 代码注入到远程代码执行 CVSS 9.4（严重） | 代码注入（CWE-94） 概述 protobuf.js（npm：protobufjs）版本 ≤ 7.5.4 和 ≤ 8.0.0 存在通过 protobuf schema 中 type 名称导致的任意代码执行 漏洞。@protobufjs/codegen 模块将 type 名称直接拼接进 JavaScript 字符串，再通过 Function 构造函数执行（等同于 eval）。能够控制 schema 的攻击者可注入代码并在服务器上运行。 已修复： protobufjs 7.5.5...

CVE-2025-59528

CVE-2025-59528: Flowise CustomMCP Remote Code Execution PoC A Go proof of concept for CVE-2025-59528 targeting Flowise versions...

CVE-2025-59528-POC

CVE-2025-59528 - FlowiseAI CustomMCP Remote Code Execution CVSS 10.0 Critical | Blind RCE | FlowiseAI Flowise = 2.2.7-patch.1 and 3.0.6 Overview A critical remote code execution vulnerability in the CustomMCP node of FlowiseAI Flowise. The convertToValidJSONString function passes user-supplied...

CVE-2025-59528

...

EUVD-2026-81012

Redocly CLI makes OpenAPI validation, linting, and documentation workflows easier. Prior to version 2.33.0 of @redocly/respect-core and @redocly/cli, the respect command dynamically evaluates $faker runtime expressions in Arazzo descriptions. A crafted expression can traverse constructor,...

CVE-2025-59528.yaml

CVE-2025-59528.yaml Flowise 是一个拖放式用户界面，用于构建自定义的大语言模型流程。在 3.0.5 版本中，Flowise 存在远程代码执行漏洞。CustomMCP 节点允许用户输入用于连接外部 MCP 服务器的配置设置。该节点解析用户提供的 mcpServerConfig 字符串以构建 MCP 服务器配置。然而，在此过程中，它会在没有任何安全验证的情况下执行 JavaScript 代码。具体来说，在 convertToValidJSONString 函数内部，用户输入被直接传递给 Function 构造函数，该构造函数会将输入作为 JavaScript...

CVE-2026-57138

PraisonAI is a multi-agent teams system. From 1.4.0 until 1.7.2, codeMode in src/praisonai-ts/src/tools/builtins/code-mode.ts executes untrusted JavaScript with new Function inside withsandbox and relies on a small source-code blocklist plus shadowed process and require properties. Code can use...

CVE-2026-57138 PraisonAI codeMode sandbox escape via Function constructor

PraisonAI is a multi-agent teams system. From 1.4.0 until 1.7.2, codeMode in src/praisonai-ts/src/tools/builtins/code-mode.ts executes untrusted JavaScript with new Function inside withsandbox and relies on a small source-code blocklist plus shadowed process and require properties. Code can use...

CVE-2026-57138 PraisonAI codeMode sandbox escape via Function constructor

PraisonAI is a multi-agent teams system. From 1.4.0 until 1.7.2, codeMode in src/praisonai-ts/src/tools/builtins/code-mode.ts executes untrusted JavaScript with new Function inside withsandbox and relies on a small source-code blocklist plus shadowed process and require properties. Code can use...

CVE-2026-57138

CVE-2026-57138 is a sandbox escape in the npm package praisonai (versions ≥ 1.4.0,

CVE-2026-57138 PraisonAI codeMode sandbox escape via Function constructor

PraisonAI is a multi-agent teams system. From 1.4.0 until 1.7.2, codeMode in src/praisonai-ts/src/tools/builtins/code-mode.ts executes untrusted JavaScript with new Function inside withsandbox and relies on a small source-code blocklist plus shadowed process and require properties. Code can use...

Astra Linux – Vulnerability in node-lodash

Impact: The fix for CVE-2021-23337 https://github.com/advisories/GHSA-35jh-r3h4-6jhm added validation for the variable option in .template, but did not apply the same validation to options.imports key names. Both paths flow into the same Function constructor sink. When an application passes...

EUVD-2026-74280

n8n: Expression Sandbox Escape via Class-Field Sanitizer Rebinding Can Lead to Code Execution...

CVE-2026-86076

n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the expression compiler sanitizer resolved through dynamically scoped this and did not reject reserved class member names. A class field named sanitize could rebind the sanitizer and reach the Function...