CVE-2026-87723 Untrusted Search Path (PATH Hijacking) in fuse-archive

In Google fuse-archive versions prior to 1.24, an attacker who can prepend a directory to PATH or write a malicious binary to an attacker-controlled or writable directory appearing in PATH can hijack the execution pathway. This allows the attacker to execute arbitrary local code under the securit...

CVE-2026-87723 Untrusted Search Path (PATH Hijacking) in fuse-archive

In Google fuse-archive versions prior to 1.24, an attacker who can prepend a directory to PATH or write a malicious binary to an attacker-controlled or writable directory appearing in PATH can hijack the execution pathway. This allows the attacker to execute arbitrary local code under the securit...

CVE-2026-87723 Untrusted Search Path (PATH Hijacking) in fuse-archive

In Google fuse-archive versions prior to 1.24, an attacker who can prepend a directory to PATH or write a malicious binary to an attacker-controlled or writable directory appearing in PATH can hijack the execution pathway. This allows the attacker to execute arbitrary local code under the securit...

PT-2026-99764

Name of the Vulnerable Software and Affected Versions Google fuse-archive versions prior to 1.24 Description An attacker can hijack the execution pathway by prepending a directory to the PATH environment variable or by writing a malicious binary to a writable directory that appears in the PATH...

GLSA-202401-21 : KTextEditor: Arbitrary Local Code Execution

The remote host is affected by the vulnerability described in GLSA-202401-21 KTextEditor: Arbitrary Local Code Execution - The LSP Language Server Protocol plugin in KDE Kate before 21.12.2 and KTextEditor before 5.91.0 tries to execute the associated LSP server binary when opening a file of a...