The vulnerability of the `jinja2.Template()` function in the `api/core/helper/code_executor/jinja2/jinja2_transformer.py` file, a Jinja2 platform for application development by Dify, allows a malicious actor to execute arbitrary code.

The vulnerability of the jinja2.Template function in the api/core/helper/codeexecutor/jinja2/jinja2transformer.py file, a Jinja2 template processor for Dify application development, is related to the lack of measures taken to eliminate special elements in the template creation mechanism. Exploiti...

CVE-2026-0528 Improper Input Validation in Metricbeat Leading to Denial of Service

Improper Validation of Array Index CWE-129 exists in Metricbeat can allow an attacker to cause a Denial of Service through Input Data Manipulation CAPEC-153 via specially crafted, malformed payloads sent to the Graphite server metricset or Zookeeper server metricset. Additionally, Improper Input...

CVE-2026-0528: Improper Validation of Array Index

Improper Validation of Array Index CWE-129 exists in Metricbeat can allow an attacker to cause a Denial of Service through Input Data Manipulation CAPEC-153 via specially crafted, malformed payloads sent to the Graphite server metricset or Zookeeper server metricset. Additionally, Improper Input...

Malicious code in setup-helper-module (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7c02c25d78f51cf02062df08594fff995746429e6c4ba2e74b5a6fbddfcfb3e1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-47204 Malicious code in setup-helper-module (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7c02c25d78f51cf02062df08594fff995746429e6c4ba2e74b5a6fbddfcfb3e1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview setup-helper-module is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in helper-module-context (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 778627c6fddd3213ecd51919302043e954a27431ff63b240135308cd3d9a6512 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3606 Malicious code in helper-module-context (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 778627c6fddd3213ecd51919302043e954a27431ff63b240135308cd3d9a6512 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2007-0461: Undefined Security Weakness

Multiple memory leaks in the Dazuko anti-virus helper module before 2.3.2 allow attackers to cause a denial of service memory consumption via unknown vectors...