39 matches found
CVE-2026-123847
In JetBrains IntelliJ IDEA before 2026.3 command execution was possible via control characters in terminal command completion...
CVE-2026-123847
In JetBrains IntelliJ IDEA versions prior to 2026.3 , a vulnerability exists where command execution is possible via the use of control characters during terminal command completion . The root cause is identified as the improper neutralization of escape, meta, or control sequences (CWE-150 ). No ...
CVE-2026-123847
In JetBrains IntelliJ IDEA before 2026.3 command execution was possible via control characters in terminal command completion...
EUVD-2026-118350
In JetBrains IntelliJ IDEA before 2026.3 command execution was possible via control characters in terminal command completion...
CVE-2026-123847: JetBrains IntelliJ IDEA: In JetBrains IntelliJ IDEA before 2026.3 command execution was possible via control characters in terminal command…
In JetBrains IntelliJ IDEA before 2026.3 command execution was possible via control characters in terminal command completion...
JetBrains IntelliJ IDEA < 2026.2.2 Information Disclosure (CVE-2026-86501)
The version of JetBrains IntelliJ IDEA installed on the remote host is prior to 2026.2.2. It is, therefore, affected by an information disclosure vulnerability: - In JetBrains IntelliJ IDEA before 2026.2.2 terminal command input could be written to idea.log. CVE-2026-86501 Note that Nessus has no...
CVE-2026-86501: Insertion of Sensitive Information into Log File
In JetBrains IntelliJ IDEA before 2026.2.2 terminal command input could be written to idea.log...
EUVD-2026-70525
A component of the MongoDB extension for Visual Studio Code does not neutralize special characters in a connection string before that value is placed into a command line the extension composes for an integrated terminal. An unauthenticated remote unauthorized-user who persuades a developer to...
CVE-2026-53457 Blueprint Studio terminal command working directory not bounded to config directory
Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, the legacy stateless terminal command execution path in customcomponents/blueprintstudio/backend/terminalmanager.py accepted a cwd working-directory parameter and checked only whether the...
CVE-2026-53457 Blueprint Studio terminal command working directory not bounded to config directory
Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, the legacy stateless terminal command execution path in customcomponents/blueprintstudio/backend/terminalmanager.py accepted a cwd working-directory parameter and checked only whether the...
CVE-2026-53457 Blueprint Studio terminal command working directory not bounded to config directory
Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, the legacy stateless terminal command execution path in customcomponents/blueprintstudio/backend/terminalmanager.py accepted a cwd working-directory parameter and checked only whether the...
CVE-2026-53457
In Blueprint Studio before 2.5.2, the legacy terminal path in terminal_manager.py accepted a cwd parameter and only checked directory existence, allowing an admin to run commands in directories outside the Home Assistant config boundary, weakening filesystem restrictions. Fixed in version 2.5.2. ...
CVE-2026-54540
Pheditor is a single-file editor and file manager written in PHP. Prior to version 2.0.5, there is an authenticated terminal command whitelist bypass. The terminal feature checks whether the submitted command starts with one of the configured TERMINALCOMMANDS values, then passes the full command...
CVE-2026-5972
A vulnerability has been found in FoundationAgents MetaGPT up to 0.8.1. This issue affects the function Terminal.runcommand in the library metagpt/tools/libs/terminal.py. The manipulation leads to os command injection. Remote exploitation of the attack is possible. The exploit has been disclosed ...
CVE-2026-5972 FoundationAgents MetaGPT terminal.py Terminal.run_command os command injection
A vulnerability has been found in FoundationAgents MetaGPT up to 0.8.1. This issue affects the function Terminal.runcommand in the library metagpt/tools/libs/terminal.py. The manipulation leads to os command injection. Remote exploitation of the attack is possible. The exploit has been disclosed ...
CVE-2026-30310: Improper Neutralization of Special Elements used in a Command
In its design for automatic terminal command execution, Sixth offers two options: Execute safe commands and Execute all commands. The description for the former states that commands determined by the model to be safe will be automatically executed, whereas if the model judges a command to be...
CVE-2026-30308
In its design for automatic terminal command execution, HAI Build Code Generator offers two options: Execute safe commands and Execute all commands. The description for the former states that commands determined by the model to be safe will be automatically executed, whereas if the model judges a...
CVE-2026-30304
In its design for automatic terminal command execution, AI Code offers two options: Execute safe commands and execute all commands. The description for the former states that commands determined by the model to be safe will be automatically executed, whereas if the model judges a command to be...
AI Code security vulnerabilities
AI Code is a code programming assistant developed by TianGuaDuiZhang. AI Code has a security vulnerability, which stems from the design of automatic terminal command execution, making it susceptible to prompt injection attacks, potentially allowing arbitrary command execution...
Fake CleanMyMac site installs SHub Stealer and backdoors crypto wallets
A convincing fake version of the popular Mac utility CleanMyMac is tricking users into installing malware. The site instructs visitors to paste a command into Terminal. If they do, it installs SHub Stealer, macOS malware designed to steal sensitive data including saved passwords, browser data,...