EUVD-2026-65549

mcp-shell is an MCP server for running shell commands securely, auditably, and on demand. Prior to 0.6.0, the default Docker security.yaml includes /bin/bash in allowedexecutables, while security.go validates only the first token and checkBlockedPatternsAndCommands does not reject the shell...

CVE-2026-76072: Incomplete List of Disallowed Inputs

The Continue CLI applies an incomplete denylist as its only barrier to destructive shell commands when running unattended. In headless mode and auto mode the default policy in extensions/cli/src/permissions/defaultPolicies.ts grants the Bash tool the allow permission, and permissionChecker.ts...

dsh2shell

dsh2shell Unauthenticated RCE PoC for expo...

ROOT-OS-DEBIAN-11-CVE-2022-3715 CVE-2022-3715 in bash - Patched by Root

Root has patched CVE-2022-3715 in the bash package for Root:Debian:11. Multiple fixed versions available...

GHSA-FJ27-X67R-V4G5 vulnerabilities

Vulnerabilities for packages: busybox...

ROOT-OS-UBUNTU-2510-CVE-0000-0000 CVE-0000-0000 in bash - Patched by Root

Root has patched CVE-0000-0000 in the bash package for Root:Ubuntu:25.10. Multiple fixed versions available...

GHSA-FHGH-WQ4Q-R37X uniget CLI: Metadata signature verification only runs when UNIGET_IGNORE_METADATA_SIGNATURE is set

Summary The sigstore check on metadata.json is gated on the wrong side of the condition. LoadMetadata in internal/config/update.go:81 verifies the bundle only when UNIGETIGNOREMETADATASIGNATURE is non-empty, so in a normal run, where nobody sets that variable, the signature is never checked...

ANT-2026-6JWE6ZK7 · langchain-ai/deepagentsjs · sandbox_escape

other high Severity Claude high · Security research firm high · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Anvil Security. ANT-2026-6JWE6ZK7: VFS sandbox executes agent commands directly on host T...

Hack-The-Box-Connected-Full-Machine-Walkthrough

Hack The Box — Connected Platform: Hack The Box Mac...

cmdchamp v1.3.0

cmdchamp Bash CLI trainer — 30 levels from ls to privilege escalation. Every question asks you to type a real command — get instant feedback, move on. Many run against real files in the sandbox, and all accept multiple valid syntaxes sort -u or sort | uniq. Tab toggles the manpage when you need a...

CVE-2026-73614: Interpretation Conflict

Network-AI ClaudeHookBridge before 5.15.1 truncates the target string to 500 characters before evaluating denyPatterns, while Claude Code executes the full untruncated command. Attackers can position dangerous content past byte 500 in a Bash command field to bypass the operator's hard-deny list a...

CVE-2026-73036

Bash-it 3.2.0 contains a terminal escape sequence injection vulnerability in the barbuk theme's Python virtualenv prompt segment that allows local attackers to inject arbitrary terminal control sequences by embedding escape sequences in the requires-python field of a pyproject.toml file. When a...

CVE-2026-73036 Bash-it barbuk Theme 3.2.0 Terminal Escape Sequence Injection via pyproject.toml

Bash-it 3.2.0 contains a terminal escape sequence injection vulnerability in the barbuk theme's Python virtualenv prompt segment that allows local attackers to inject arbitrary terminal control sequences by embedding escape sequences in the requires-python field of a pyproject.toml file. When a...

CVE-2026-73036 Bash-it barbuk Theme 3.2.0 Terminal Escape Sequence Injection via pyproject.toml

Bash-it 3.2.0 contains a terminal escape sequence injection vulnerability in the barbuk theme's Python virtualenv prompt segment that allows local attackers to inject arbitrary terminal control sequences by embedding escape sequences in the requires-python field of a pyproject.toml file. When a...

CVE-2026-73036

CVE-2026-73036 affects Bash-it 3.2.0 (barbuk theme, Python virtualenv prompt segment). A vulnerability arises when a directory contains a malicious pyproject.toml where a crafted requires-python field is read (via awk) and concatenated into PS1 through __prompt-command without stripping control c...

CVE-2026-73036

Bash-it 3.2.0 contains a terminal escape sequence injection vulnerability in the barbuk theme's Python virtualenv prompt segment that allows local attackers to inject arbitrary terminal control sequences by embedding escape sequences in the requires-python field of a pyproject.toml file. When a...

EUVD-2026-56927

Bash-it 3.2.0 contains a terminal escape sequence injection vulnerability in the barbuk theme's Python virtualenv prompt segment that allows local attackers to inject arbitrary terminal control sequences by embedding escape sequences in the requires-python field of a pyproject.toml file. When a...

CVE-2026-73036 Bash-it barbuk Theme 3.2.0 Terminal Escape Sequence Injection via pyproject.toml

Bash-it 3.2.0 contains a terminal escape sequence injection vulnerability in the barbuk theme's Python virtualenv prompt segment that allows local attackers to inject arbitrary terminal control sequences by embedding escape sequences in the requires-python field of a pyproject.toml file. When a...

PT-2026-70891

Bash-it 3.2.0 contains a terminal escape sequence injection vulnerability in the barbuk theme's Python virtualenv prompt segment that allows local attackers to inject arbitrary terminal control sequences by embedding escape sequences in the requires-python field of a pyproject.toml file. When a...

CVE-2026-73036: Improper Neutralization of Escape, Meta, or Control Sequences

Bash-it 3.2.0 contains a terminal escape sequence injection vulnerability in the barbuk theme's Python virtualenv prompt segment that allows local attackers to inject arbitrary terminal control sequences by embedding escape sequences in the requires-python field of a pyproject.toml file. When a...