CVE-2026-67531

CVE-2026-67531 affects FrontMCP before 1.5.7. The sandboxed codecall:execute tool could leak live host Zod schema instances to scripts via getTool, and due to Zod v4 _zod being non-configurable/non-writable, the ECMAScript Proxy invariant returned the raw host object. This allowed a script to rea...

CVE-2026-67531 FrontMCP: CodeCall sandbox escape -> host RCE via live Zod schema exposure by getTool

FrontMCP is a TypeScript-first framework for the Model Context Protocol MCP. Prior to 1.5.7, the sandboxed codecall:execute tool exposes live host Zod schema instances to the script via getTool, and because Zod v4 defines zod as a non-configurable, non-writable own property, the ECMAScript Proxy...

MAL-2026-13380 Malicious code in uncrypt (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 61fc5c3033efaa35a8eae7781fa0fc4b300f753c5b0d56e07adcc0557e9b648f The package presents itself as a trivial Python XOR/hex helper, but uncrypt/init.py executes runsecuritylauncher at module top level, which...

Malicious code in uncrypt (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 61fc5c3033efaa35a8eae7781fa0fc4b300f753c5b0d56e07adcc0557e9b648f The package presents itself as a trivial Python XOR/hex helper, but uncrypt/init.py executes runsecuritylauncher at module top level, which...

CVE-2026-66298

CVE-2026-66298 concerns Livebook’s JS-view sandbox where untrusted, notebook-defined JavaScript can trigger session-wide keyboard shortcuts. The root cause is in the trusted iframe shell forwarding every keydown to the parent without checking Event.isTrusted, allowing events synthesized by the un...

GHSA-F2R8-JV7C-XQMP Electron: DevTools embedder handler executes arbitrary files via shell open

Impact The DevTools "reveal in file manager" action could launch the target file rather than reveal it. An attacker with a separate means of running script inside the DevTools frontend such as a malicious DevTools extension could use this to execute native code outside the sandbox. Apps are only...

Command Injection

Overview org.webjars.npm:electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Affected versions of this package are vulnerable to Command Injection in the DevTools embedder handler. An attacker can execute arbitrary files outside the...

EUVD-2026-53545

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.9, 40.9.2, 41.2.1, and 42.0.0-beta.3, the DevTools reveal in file manager action could launch the target file rather than reveal it. An attacker with a separate means of running...

CVE-2026-70611 Electron: DevTools embedder handler executes arbitrary files via shell open

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.9, 40.9.2, 41.2.1, and 42.0.0-beta.3, the DevTools reveal in file manager action could launch the target file rather than reveal it. An attacker with a separate means of running...

CVE-2026-70611

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.9, 40.9.2, 41.2.1, and 42.0.0-beta.3, the DevTools reveal in file manager action could launch the target file rather than reveal it. An attacker with a separate means of running...

CVE-2026-70611 Electron: DevTools embedder handler executes arbitrary files via shell open

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.9, 40.9.2, 41.2.1, and 42.0.0-beta.3, the DevTools reveal in file manager action could launch the target file rather than reveal it. An attacker with a separate means of running...

CVE-2026-70611

CVE-2026-70611 affects Electron: prior to 39.8.9, 40.9.2, 41.2.1, and 42.0.0-beta.3, the DevTools reveal in file manager action could launch the target file instead of revealing it. An attacker with a separate means of running script inside the DevTools frontend (e.g., a malicious DevTools extens...

CVE-2026-70611 Electron: DevTools embedder handler executes arbitrary files via shell open

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.9, 40.9.2, 41.2.1, and 42.0.0-beta.3, the DevTools reveal in file manager action could launch the target file rather than reveal it. An attacker with a separate means of running...

Improper Restriction of Rendered UI Layers or Frames

Overview org.webjars.npm:electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Affected versions of this package are vulnerable to Improper Restriction of Rendered UI Layers or Frames in the OpenURL navigation path, which allows a sandbox...

CVE-2026-70601 Electron: Context isolation bypass via Function.prototype.bind hijack

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.9, 40.9.2, 41.2.2, and 42.0.0-beta.5, apps that expose Promise-returning functions to web content via contextBridge may be vulnerable to a context isolation bypass. Untrusted web...

Malicious code in bnpl-blocks-atom-bnpl-base-popup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a7ff15e65896892e348d28080e20d974d32a0f8cd2bb5b523e63b9b3d35395e3 On require of the package, index.js loads polyfill.js, which assembles Cloudflare Workers hostnames oob-worker.cf100-416.workers.dev,...

MAL-2026-12865 Malicious code in bnpl-blocks-atom-bnpl-base-popup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a7ff15e65896892e348d28080e20d974d32a0f8cd2bb5b523e63b9b3d35395e3 On require of the package, index.js loads polyfill.js, which assembles Cloudflare Workers hostnames oob-worker.cf100-416.workers.dev,...

CVE-2026-71291

Bolt CMS renders content field values through Twig's full application-level Environment with no SandboxExtension registered anywhere in the codebase. In src/Entity/Field.php, getTwigValue calls shouldBeRenderedAsTwig, which gates rendering only on the field definition's allowtwig flag and a regex...

CVE-2026-71291

Bolt CMS renders content field values through Twig's full application-level Environment with no SandboxExtension registered anywhere in the codebase. In src/Entity/Field.php, getTwigValue calls shouldBeRenderedAsTwig, which gates rendering only on the field definition's allowtwig flag and a regex...

EUVD-2026-53376

Bolt CMS renders content field values through Twig's full application-level Environment with no SandboxExtension registered anywhere in the codebase. In src/Entity/Field.php, getTwigValue calls shouldBeRenderedAsTwig, which gates rendering only on the field definition's allowtwig flag and a regex...