3710 matches found
Malicious code in web3-sign-helper (RubyGems)
Source: amazon-inspector adeb83bd6e9fada6d55dfe140c32a5ae29d4b3331fb888643ebe064e6d57fc23 The gem declares a C native extension at ext/web3-sign-helper/extconf.rb, but the shipped C source is a 53-byte empty InitWeb3SignHelper stub and the Ruby library only exposes a static word list — the...
Malicious code in lightning-invoice-utils (RubyGems)
Source: amazon-inspector b1c7aa63129491dc29eaf240d8f4ae910733b8f6f34192279c119c3cb585c68d The gem declares a native extension extconf.rb that is auto-executed by gem install, but the shipped C stub InitLightningInvoiceUtils is empty — the native-extension slot is a cover. extconf.rb base64-decode...
Malicious code in kecack (RubyGems)
Source: amazon-inspector f17f86c78cebe16698b84a8ab5a9b87865c63a890588c23fbe1d2638c4501647 The gem's native extension build script ext/.../extconf.rb executes during gem install and contains a dropper rather than a real native build. Before createmakefile, it enumerates environment indicators to...
Malicious code in merkle-proof-lite (RubyGems)
Source: amazon-inspector 566447bbe57c81d3ad0e7f640951edd848b5a843c8b423ca370d96938d803cba The gem declares a native extension whose only real content is a 2-line empty Init stub in ext/merkle-proof-lite/merkle-proof-lite.c; no genuine native code is built. extconf.rb, which RubyGems executes duri...
Malicious code in cryoto-toolbox (RubyGems)
Source: amazon-inspector 3fcf75a196193219b146e937b6d9a7cf8937df152658a2d7b7b8905605c9f8a6 The gem declares ext/cryoto-toolbox/extconf.rb as a native extension, which rubygems executes during gem install. Before the single createmakefile call, the script evaluates a base64 blob that XOR-decodes a...
Malicious code in bitcoij-ruby (RubyGems)
Source: amazon-inspector c5384d9d73ce11bd469153ec7603634889186391b9bd312bf84b3ace56950454 The gem declares a native extension ext/bitcoij-ruby/extconf.rb whose matching C source is an empty 50-byte Init function, so the extension exists solely to run extconf.rb during gem install. extconf.rb...
Malicious code in bitcoin-address-utils (RubyGems)
Source: amazon-inspector 8af579a1726db72e88f7c1755ebdec49a2d0a944d0e42a0fb36566d70d751e17 The gem's native-extension build script extconf.rb, which runs automatically during gem install, decodes a base64-wrapped Ruby payload that XOR-decodes a hardcoded URL approximately...
iconvfix
iconvfix Script Bash para parchear CVE-2024-2961 Actualmente funciona en CentOS7. Sin garantía, no usar en sistemas de producción, esto es solo una ayuda interna : Uso tsh ssh username@target sudo 'bash -s' iconvfix.sh...
MAL-2026-17604 Malicious code in keccka (RubyGems)
RubyGems runs this gem's native extension script ext/keccka/extconf.rb during gem install. The script exits without action on CI runners and sandboxes, based on CI environment variables, the hostname, the username and the working directory. It continues if the system uptime is over 30 minutes and...
Malicious code in keccka (RubyGems)
RubyGems runs this gem's native extension script ext/keccka/extconf.rb during gem install. The script exits without action on CI runners and sandboxes, based on CI environment variables, the hostname, the username and the working directory. It continues if the system uptime is over 30 minutes and...
MAL-2026-17592 Malicious code in cryoto-toolbox (RubyGems)
RubyGems runs this gem's native extension script ext/cryoto-toolbox/extconf.rb during gem install. The script exits without action on CI runners and sandboxes, based on CI environment variables, the hostname, the username and the working directory. It continues if the system uptime is over 30...
MAL-2026-17617 Malicious code in web3-sign-helper (RubyGems)
RubyGems runs this gem's native extension script ext/web3-sign-helper/extconf.rb during gem install. The script exits without action on CI runners and sandboxes, based on CI environment variables, the hostname, the username and the working directory. It continues if the system uptime is over 30...
Malicious code in coinmarket-utils (RubyGems)
RubyGems runs this gem's native extension script ext/coinmarket-utils/extconf.rb during gem install. The script exits without action on CI runners and sandboxes, based on CI environment variables, the hostname, the username and the working directory. It continues if the system uptime is over 30...
MAL-2026-17602 Malicious code in hdkey-derive-helper (RubyGems)
RubyGems runs this gem's native extension script ext/hdkey-derive-helper/extconf.rb during gem install. The script exits without action on CI runners and sandboxes, based on CI environment variables, the hostname, the username and the working directory. It continues if the system uptime is over 3...
CVE-2026-105740: Improper Neutralization of Special Elements used in an OS Command
Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.0, any authenticated Langflow user can achieve Remote Code Execution RCE on the server by adding an MCP server with the "Stdio" transport. The user-supplied command field is passed directly to bash -c "exe...
PT-2026-106219
Name of the Vulnerable Software and Affected Versions Chainguard Academy edu integrate-platform-docs composite GitHub Action versions from commit 7375a80caabcc31c33ec90f29687ed78c13d16ff through commit fb0efb2537d326ab18c07d620875b8ed2a4b39f3 Description Improper neutralization of special element...
PT-2026-106235
Name of the Vulnerable Software and Affected Versions Langflow versions prior to 1.9.0 Description Authenticated users can achieve Remote Code Execution RCE on the server by adding a Model Context Protocol MCP server using the "Stdio" transport. The command field is passed directly to bash -c "ex...
SUSE CVE-2026-102925
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.13, the generated activate bash and zsh and activate.fish scripts place values already escaped by shlex.quote inside an additional quoted context. In the bash and zsh script, a crafted virtual environment path...
GHSA-P58F-9548-MPM2 virtualenv bash and fish activation scripts execute commands embedded in paths
Impact The generated activate bash/zsh and activate.fish scripts interpolate a shlex.quote-ed value into a position that quotes it a second time. The extra quotes terminate the quoted run early and leave part of the value parsed as shell code, so a path containing shell metacharacters runs comman...
