NocoBase - VM Sandbox Escape to Remote Code Execution

NocoBase Workflow Script Node executes user-supplied JavaScript inside a Node.js vm sandbox with a custom require allowlist controlled by WORKFLOWSCRIPTMODULES env var. The console object passed into the sandbox context exposes host-realm WritableWorkerStdio stream objects via console.stdout and...

Mesop AI Sandbox <= 1.2.2 - Remote Code Execution

Mesop = 1.2.2 contains an unrestricted remote code execution caused by unauthenticated ingestion and execution of base64-encoded Python code in the /exec-py endpoint of ai/testing module, letting attackers execute arbitrary commands on the host, exploit requires HTTP access to the server. id:...

ServiceNow AI Platform - Pre-Auth JavaScript Sandbox Escape RCE

ServiceNow AI Platform Brazil, Australia, Zurich, and Yokohama releases before patching contains a pre-authentication remote code execution vulnerability. The /assessmentthanks.do endpoint passes the sysparmassessabletype parameter into GlideRecord's addQuery, which evaluates "javascript:" prefix...

Crawl4AI <= 0.8.6 - Remote Code Execution

Crawl4AI through 0.8.6 ships a Docker API server that exposes an unauthenticated /crawl endpoint. The computed field type of JsonCssExtractionStrategy evaluates a user supplied expression inside an AST based sandbox that does not restrict attribute access on generator frame objects. A generator...

NestJS DevTools Integration - Remote Code Execution

Nest is a framework for building scalable Node.js server-side applications. In versions 0.2.0 and below, a critical Remote Code Execution RCE vulnerability was discovered in the @nestjs/devtools-integration package. When enabled, the package exposes a local development HTTP server with an API...

SandBox_CVE-2021-23358

This repository does not have a README...

CVE-2026-86948

This issue was addressed by enforcing library validation on the affected binaries. This issue is fixed in Xcode 27. An app may be able to break out of its sandbox...

CVE-2026-86949

This issue was addressed by enforcing library validation on the affected binaries. This issue is fixed in Xcode 27. A malicious app may be able to break out of its sandbox...

CVE-2026-86961

A race condition was addressed with additional validation. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27. A malicious app may be able to break out of its sandbox...

CVE-2026-109440

LangAlpha through 2026.09.07 contains an indirect prompt injection vulnerability that allows remote attackers to execute shell commands or Python by planting instructions in web content retrieved by the agent. Because Bash and ExecuteCode lack an allow-list and human-in-the-loop approval, attacke...

CVE-2026-109441

LangAlpha through 2026.09.07 contains an improper isolation vulnerability that places all tenants' sandbox containers on Docker's shared default bridge network with inter-container communication enabled. Authenticated users with code execution in their own sandbox can connect directly to other...

CVE-2026-86961

A race condition in Apple software allows a malicious application to potentially break out of its sandbox . The underlying cause is a lack of proper synchronization, which has been addressed with additional validation. This vulnerability affects iOS , iPadOS , and macOS (specifically macOS Golden...

CVE-2026-86961

A race condition was addressed with additional validation. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27. A malicious app may be able to break out of its sandbox...

EUVD-2026-104734

A race condition was addressed with additional validation. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27. A malicious app may be able to break out of its sandbox...

EUVD-2026-104729

This issue was addressed by enforcing library validation on the affected binaries. This issue is fixed in Xcode 27. A malicious app may be able to break out of its sandbox...

CVE-2026-86948

The Xcode software is affected by a vulnerability that could allow an application to break out of its sandbox . The root cause involves a lack of library validation on certain binaries. This issue is resolved in Xcode 27 by enforcing the necessary library validation. No information regarding spec...

EUVD-2026-104728

This issue was addressed by enforcing library validation on the affected binaries. This issue is fixed in Xcode 27. An app may be able to break out of its sandbox...

CVE-2026-86949

A security vulnerability in Xcode (specifically the Xcode component on macOS Tahoe 26.6 and later) allows a malicious app to break out of its sandbox . The root cause involves a lack of library validation on affected binaries. This issue has been addressed by enforcing library validation on the a...

CVE-2026-86948

This issue was addressed by enforcing library validation on the affected binaries. This issue is fixed in Xcode 27. An app may be able to break out of its sandbox...

CVE-2026-86949

This issue was addressed by enforcing library validation on the affected binaries. This issue is fixed in Xcode 27. A malicious app may be able to break out of its sandbox...