CVE-2026-65611

nnn (terminal file manager) is vulnerable to shell command injection via an unsanitized path variable. An attacker can craft a directory name containing a single quote followed by shell syntax on a shared filesystem, removable media, or inside an extracted archive. When a victim navigates into th...

CVE-2026-65611 Shell Command Injection in nnn

nnn does not sanitize the path variable. An attacker can create a directory on a shared filesystem, removable media, or inside an extracted archive whose name contains a single quote followed by shell syntax. If the victim enters that directory in nnn and uses the batch copy or move workflow, the...

CVE-2026-65611 Shell Command Injection in nnn

nnn does not sanitize the path variable. An attacker can create a directory on a shared filesystem, removable media, or inside an extracted archive whose name contains a single quote followed by shell syntax. If the victim enters that directory in nnn and uses the batch copy or move workflow, the...

Malicious code in setup-codex (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 957e8b8d535ccc5e5d7e84e99a51695f7a50a4417bfca5f3582ae2817ca75846 The package's lib/report.js requires childprocess, fs, https, and os at the top of the module and constructs an HTTPS POST to a hardcoded destination...

CVE-2026-65612: Improper Neutralization of Special Elements used in an OS Command

nnn does not sanitize the filename variable. An attacker can place a file with a crafted name on a shared filesystem, removable media, or inside an extracted archive whose name contains a single quote followed by shell syntax. If the victim navigates to that file and opens it with preview-tabbed,...

PT-2026-78410

Renovate versions =32.124.0 and before 42.68.5 and Mend renovate-ce/renovate-ee before 13.3.0 contain a command injection vulnerability in Gradle Wrapper artifact handling. When Renovate processes Gradle Wrapper updates, it invokes a wrapper update command via a shell e.g. /bin/sh -c ... ./gradle...

PT-2026-80671

Stata Command Injection via Unsanitized package in ado package install Summary The ado package install MCP tool in stata-mcp concatenates user-controlled input directly into a Stata command string without any validation or sanitization. An attacker who can invoke the MCP tool or the equivalent...

CVE-2026-63187: Improper Control of Generation of Code

Logto is the modern, open-source auth infrastructure for SaaS and AI apps. From 1.40.1 until 1.41.0, Logto's .github/workflows/commitlint.yml directly interpolated github.event.pullrequest.title into the Commitlint on PR title step's inline echo command before piping the title to npx commitlint. ...

CVE-2026-50187 Oh My Zsh: Arbitrary Code Execution in oh-my-zsh dotenv plugin via malicious .env files

Oh My Zsh is a community-driven framework for managing Zsh configuration. Prior to 2026-05-28, the dotenv plugin in plugins/dotenv/dotenv.plugin.zsh passes ZSHDOTENVFILE to source after a directory change into a folder containing a .env file, allowing syntactically valid shell commands in the fil...

CVE-2026-75911: Improper Control of Generation of Code

CodeWhale versions before 0.8.64 fail to properly validate the allowshell configuration parameter from project config files, allowing attackers to enable arbitrary shell command execution by committing a malicious .codewhale/config.toml file to a repository. When a user clones and opens the...

CVE-2026-50187: Improper Control of Generation of Code

Oh My Zsh is a community-driven framework for managing Zsh configuration. Prior to 2026-05-28, the dotenv plugin in plugins/dotenv/dotenv.plugin.zsh passes ZSHDOTENVFILE to source after a directory change into a folder containing a .env file, allowing syntactically valid shell commands in the fil...

PT-2026-80517

libgit2 versions v0.27.0 through v1.9.0 built with the libssh2 SSH backend USE SSH=libssh2 contain a shell command injection vulnerability that allows remote attackers to execute arbitrary commands on an SSH server by supplying a repository path containing unescaped shell metacharacters such as...

CVE-2026-48553

Nagios Core before 4.5.13 and Nagios XI before 2026R1.5 are vulnerable to authenticated remote code execution via custom-variable macro injection through the Nagios Remote Data Processor NRDP. When a custom variable defined on a host, service, or contact is referenced in a shell-executed command...

Malicious code in @years19/n8n-nodes-utils-helper-a (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3bd60aaab1ca86f97939ddbea892feba63b7d911dd038a8d6f348ece5af3a76e The package advertises itself as an n8n utility helper and registers a trivial stub node nodes/PwnNode.node.js, but its postinstall lifecycle script...

Malicious code in @years17/n8n-nodes-utils-helper-c (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 983dd9c9e4907f30015aa86aceae1cc95f5511f3de89eadb7b8550a1485c7d24 The package registers a postinstall script also duplicated as the main entry that runs shell reconnaissance on the installer host — id, hostname,...

CVE-2026-14863

FileRun up to and including version 2026.2.0 contains an OS command injection vulnerability that allows authenticated attackers to achieve remote code execution by uploading a file with a malicious filename containing shell command substitution sequences. The thumbnail generation system passes...

CVE-2026-73224 Electerm check folder size function may get attacked by unsafe folder name

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.15.120, electerm allows a malicious FTP or SFTP server to execute arbitrary commands when a user downloads a crafted folder and invokes Properties and Calculate Size because calcLocal in...

CVE-2026-73222

Claude Code Templates is a CLI tool for configuring and monitoring Claude Code. Prior to 1.29.4, the Claude Code Studio server launched by the --studio option in cli-tool/src/sandbox-server.js binds to all interfaces on port 3444, permits cross-origin requests, and requires no authentication. The...

PT-2026-70876

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.15.120, electerm allows a malicious FTP or SFTP server to execute arbitrary commands when a user downloads a crafted folder and invokes Properties and Calculate Size because calcLocal in...

CVE-2026-5917: Improper Neutralization of Special Elements used in an OS Command

libgit2 versions before 1.8.7 and 1.9.0 before 1.9.7 built with the libssh2 SSH backend USESSH=libssh2 contain a shell command injection vulnerability that allows remote attackers to execute arbitrary commands on an SSH server by supplying a repository path containing unescaped shell metacharacte...