GHSA-WR3R-JHMC-F6JW vulnerabilities

Vulnerabilities for packages: gitlab-runner...

CVE-2026-89078 vulnerabilities

Vulnerabilities for packages: gitlab-runner...

GHSA-9CHR-4X58-948M vulnerabilities

Vulnerabilities for packages: gitlab-runner...

CVE-2026-93577 vulnerabilities

Vulnerabilities for packages: gitlab-runner...

CVE-2026-92628 vulnerabilities

Vulnerabilities for packages: gitlab-runner...

CVE-2026-51872: Improper Control of Generation of Code

Devika v1.0 is vulnerable to Code Injection via the Runner.runcode function in src/agents/runner/runner.py...

CVE-2026-51872

Devika v1.0 is vulnerable to Code Injection via the Runner.runcode function in src/agents/runner/runner.py...

PT-2026-103620

Name of the Vulnerable Software and Affected Versions Devika version 1.0 Description Code Injection is possible through the run code function within the Runner class located in src/agents/runner/runner.py. Recommendations As a temporary workaround, consider disabling the run code function until a...

CVE-2026-51871

Devika v1.0 is vulnerable to Code Injection in the Runner.execute function in src/agents/runner/runner.py which allows an attacker to achieve arbitrary code execution by exploiting the direct execution of LLM-generated content...

EUVD-2026-90411

Devika v1.0 is vulnerable to Code Injection via the Runner.runcode function in src/agents/runner/runner.py...

CVE-2026-51871

Devika v1.0 is vulnerable to Code Injection in the Runner.execute function in src/agents/runner/runner.py which allows an attacker to achieve arbitrary code execution by exploiting the direct execution of LLM-generated content...

Malicious code in native-runner (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c057973da17ec629b4cd8c10a2b74108761f4a9ad4a1a31b280031da1f7139ca On require'native-runner', a top-level IIFE in index.js polls for up to two minutes for a file at %APPDATA%\Microsoft\Windows\noderuntimehelper.exe...

MAL-2026-17218 Malicious code in native-runner (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c057973da17ec629b4cd8c10a2b74108761f4a9ad4a1a31b280031da1f7139ca On require'native-runner', a top-level IIFE in index.js polls for up to two minutes for a file at %APPDATA%\Microsoft\Windows\noderuntimehelper.exe...

Malicious Package

Overview native-runner is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

CVE-2026-100650

Versions of vLLM through 0.29.0 are vulnerable to a resource exhaustion flaw where the system fully materializes remote or inline media before enforcing documented size and quantity limits (such as VLLM_MAX_AUDIO_CLIP_FILESIZE_MB ). The vulnerability exists across four ingress paths: the shared m...

PT-2026-99321

Name of the Vulnerable Software and Affected Versions vLLM versions prior to 0.29.1 Description The server fetches and fully materializes remote or inline media before enforcing media controls, such as the VLLM MAX AUDIO CLIP FILESIZE MB size cap and the --limit-mm-per-prompt item limits. This...

CVE-2026-100369 CliInvoke: Argument Injection in Extensibility Runner Factory

CliInvoke and its formerly named AlastairLundy.CliInvoke package are .NET libraries for invoking command-line programs and wrapping executable processes. CliInvoke versions 2.0.0 through 2.8.4, 2.9.0 through 2.9.3, 2.10.0 through 2.10.4, and 3.0.0-alpha.1 through 3.0.0-beta.1, as well as...

CVE-2026-100369 CliInvoke: Argument Injection in Extensibility Runner Factory

CliInvoke and its formerly named AlastairLundy.CliInvoke package are .NET libraries for invoking command-line programs and wrapping executable processes. CliInvoke versions 2.0.0 through 2.8.4, 2.9.0 through 2.9.3, 2.10.0 through 2.10.4, and 3.0.0-alpha.1 through 3.0.0-beta.1, as well as...

PT-2026-99117

Name of the Vulnerable Software and Affected Versions CliInvoke versions 2.0.0 through 2.8.4 CliInvoke versions 2.9.0 through 2.9.3 CliInvoke versions 2.10.0 through 2.10.4 CliInvoke versions 3.0.0-alpha.1 through 3.0.0-beta.1 AlastairLundy.CliInvoke versions 2.0.0-alpha.1 through 2.0.0 Descripti...

CVE-2026-97225

A flaw has been found in DbGate up to 7.2.5-beta.5. This affects an unknown function of the file packages/api/src/controllers/runners.js of the component JSON Runner. Executing a manipulation of the argument comment.text/script.schedule can lead to code injection. The attack may be performed from...