CVE-2026-51858: Improper Control of Generation of Code

In camel-ai camel 0.2.91a1, v0.2.91a2 and v0.2.91a3, TerminalToolkit.shellexec allows prompt-driven shell command execution without an approval boundary...

PT-2026-103609

Name of the Vulnerable Software and Affected Versions camel-ai camel versions 0.2.91a1 through 0.2.91a3 Description The shell exec function within the TerminalToolkit allows for shell command execution driven by prompts without an approval boundary, which can lead to shell command injection...

EUVD-2026-90422

In camel-ai camel 0.2.91a1, v0.2.91a2 and v0.2.91a3, TerminalToolkit.shellexec allows prompt-driven shell command execution without an approval boundary...

CVE-2026-51858

In camel-ai camel 0.2.91a1, v0.2.91a2 and v0.2.91a3, TerminalToolkit.shellexec allows prompt-driven shell command execution without an approval boundary...

CVE-2026-51858

The camel-ai camel software versions v0.2.91a1 , v0.2.91a2 , and v0.2.91a3 are vulnerable to arbitrary shell command execution. The root cause is located in the TerminalToolkit.shell_exec function, which allows prompt-driven command execution without an approval boundary . This flaw falls under C...

CVE-2026-102828

simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. From 3.15.0 until 4.0.1, the default blockUnsafeOperationsPlugin does not classify trailer..cmd as unsafe configuration. An application that passes...

CVE-2026-102828 simple-git unsafe-operation guard does not block trailer command configuration

simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. From 3.15.0 until 4.0.1, the default blockUnsafeOperationsPlugin does not classify trailer..cmd as unsafe configuration. An application that passes...

CVE-2026-102828

simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. From 3.15.0 until 4.0.1, the default blockUnsafeOperationsPlugin does not classify trailer..cmd as unsafe configuration. An application that passes...

CVE-2026-102828

The simple-git library, a Node.js interface for Git commands, is vulnerable to arbitrary command execution in versions 3.15.0 through 4.0.1 . The root cause is that the default blockUnsafeOperationsPlugin fails to classify trailer..cmd as an unsafe configuration. An attacker providing controlled ...

CVE-2026-102828 simple-git unsafe-operation guard does not block trailer command configuration

simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. From 3.15.0 until 4.0.1, the default blockUnsafeOperationsPlugin does not classify trailer..cmd as unsafe configuration. An application that passes...

CVE-2026-102828 simple-git unsafe-operation guard does not block trailer command configuration

simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. From 3.15.0 until 4.0.1, the default blockUnsafeOperationsPlugin does not classify trailer..cmd as unsafe configuration. An application that passes...

CVE-2026-102697 Ollama 0.14.0 before 0.31.2 Experimental Agent Bash Approval Bypass via Prefix-Based Authorization

Ollama versions 0.14.0 before 0.31.2 contain an incorrect authorization vulnerability in the experimental agent mode Bash tool approval mechanism that fails to properly parse shell syntax. Attackers who can influence model output through prompt injection can execute additional shell commands by...

CVE-2026-82804 Apache DolphinScheduler: Command Injection in the Alert Script Plugin

The scriptPath parameter is incorporated into a /bin/sh -c command without sufficient neutralization of shell metacharacters, allowing shell command substitution and execution. An authenticated user can exploit this behavior by creating a resource whose filename contains shell command substitutio...

EUVD-2026-88812

The scriptPath parameter is incorporated into a /bin/sh -c command without sufficient neutralization of shell metacharacters, allowing shell command substitution and execution. An authenticated user can exploit this behavior by creating a resource whose filename contains shell command substitutio...

Netcore NR289-GE CVE-2026-101072 Detect

Detects CVE-2026-101072 in Netcore NR289-GE: unauthenticated OS command injection via POST /x.ico/apip.cgi boa .ico auth bypass. The ip parameter is embedded into a wget shell command without validation. Uses a short echo probe when activeprobe is enabled. !/usr/bin/env python3 -- coding: utf-8 -...

CVE-2026-82804: Improper Neutralization of Special Elements used in an OS Command

The scriptPath parameter is incorporated into a /bin/sh -c command without sufficient neutralization of shell metacharacters, allowing shell command substitution and execution. An authenticated user can exploit this behavior by creating a resource whose filename contains shell command substitutio...

PT-2026-102608

The scriptPath parameter is incorporated into a /bin/sh -c command without sufficient neutralization of shell metacharacters, allowing shell command substitution and execution. An authenticated user can exploit this behavior by creating a resource whose filename contains shell command substitutio...

PT-2026-102812

Name of the Vulnerable Software and Affected Versions simple-git versions 3.15.0 through 4.0.0 Description The default blockUnsafeOperationsPlugin fails to classify trailer..cmd as an unsafe configuration. This allows an attacker to execute arbitrary shell commands with the operating-system...

CVE-2026-75600

FreePBX is an open source IP PBX. Prior to version 17.0.9, authenticated users who are authorized to access the GraphQL api module interface of FreePBX are able to execute arbitrary shell commands. Authenticated access to the api module is required. The PBX API module's documentation generator...

EUVD-2026-88391

FreePBX is an open source IP PBX. Prior to version 17.0.9, authenticated users who are authorized to access the GraphQL api module interface of FreePBX are able to execute arbitrary shell commands. Authenticated access to the api module is required. The PBX API module's documentation generator...