CVE-2025-58371

Roo Code is an AI-powered autonomous coding agent that lives in users' editors. In versions 3.26.6 and below, a Github workflow used unsanitized pull request metadata in a privileged context, allowing an attacker to craft malicious input and achieve Remote Code Execution RCE on the Actions runner...

Exploit for Deserialization of Untrusted Data in Siemens 6Bk1602-0Aa12-0Tp0_Firmware

This repository contains operational information regarding the vulnerability in the Log4j logging library CVE-2021-44228. The vulnerability allows an attacker to execute arbitrary code on a system by injecting malicious data into the logging system. The repository provides a list of known...

poc

Proof of Concepts As the result of plugin writing or just general bug hunting, researchers at Tenable often stumble upon new and interesting vulnerabilities. These vulnerabililities are shared with the community on our company blog, Medium, or through our research advisories. We've decided to...

CVE-2025-58374 Roo Code: Auto-approve allows npm install execution of malicious postinstall scripts

Roo Code is an AI-powered autonomous coding agent that lives in users' editors. Versions 3.25.23 and below contain a default list of allowed commands that do not need manual approval if auto-approve is enabled, and npm install is included in that list. Because npm install executes lifecycle...

CVE-2025-58371 Roo Code is vulnerable to command injection via GitHub actions workflow

Roo Code is an AI-powered autonomous coding agent that lives in users' editors. In versions 3.26.6 and below, a Github workflow used unsanitized pull request metadata in a privileged context, allowing an attacker to craft malicious input and achieve Remote Code Execution RCE on the Actions runner...

MAL-2025-43529 Malicious code in astrobiology-repository-materialize-pulsar (npm)

The package astrobiology-repository-materialize-pulsar was found to contain malicious code...

Malicious code in blitz-passport-repository-venus (npm)

The package blitz-passport-repository-venus was found to contain malicious code...

Malicious code in astrobiology-repository-materialize-pulsar (npm)

The package astrobiology-repository-materialize-pulsar was found to contain malicious code...

Malicious code in heike-shegong-dangandai (npm)

The package heike-shegong-dangandai was found to contain malicious code...

Malicious code in cosmiconfig-vortex-proxima-repository (npm)

The package cosmiconfig-vortex-proxima-repository was found to contain malicious code...

Malicious code in paleoceanography-aurora-carina-repository (npm)

The package paleoceanography-aurora-carina-repository was found to contain malicious code...

MAL-2025-44034 Malicious code in dongwu-lingqi-liaoyu (npm)

The package dongwu-lingqi-liaoyu was found to contain malicious code...

MAL-2025-46475 Malicious code in upgrade-repository-dione-ora (npm)

The package upgrade-repository-dione-ora was found to contain malicious code...

MAL-2025-45499 Malicious code in paleoceanography-aurora-carina-repository (npm)

The package paleoceanography-aurora-carina-repository was found to contain malicious code...

Malicious code in upgrade-repository-dione-ora (npm)

The package upgrade-repository-dione-ora was found to contain malicious code...

MAL-2025-43631 Malicious code in blitz-passport-repository-venus (npm)

The package blitz-passport-repository-venus was found to contain malicious code...

MAL-2025-43900 Malicious code in cosmiconfig-vortex-proxima-repository (npm)

The package cosmiconfig-vortex-proxima-repository was found to contain malicious code...

fxhash - no longer maintained

The fxhash crate is no longer maintained. The repository is stale and owner is no longer active on GitHub. Please take a look at rustc-hash instead...

Exposure of Sensitive System Information to an Unauthorized Control Sphere

Overview Affected versions of this package are vulnerable to Exposure of Sensitive System Information to an Unauthorized Control Sphere via the project details API endpoint. An attacker can access sensitive repository credentials by using API tokens with project-level or project get permissions,...

Exposure of Sensitive System Information to an Unauthorized Control Sphere

Overview Affected versions of this package are vulnerable to Exposure of Sensitive System Information to an Unauthorized Control Sphere via the project details API endpoint. An attacker can access sensitive repository credentials by using API tokens with project-level or project get permissions,...