229 matches found
CVE-2025-59528: Improper Control of Generation of Code
Flowise is a drag & drop user interface to build a customized large language model flow. In version 3.0.5, Flowise is vulnerable to remote code execution. The CustomMCP node allows users to input configuration settings for connecting to an external MCP server. This node parses the user-provided...
CVE-2025-52385: Improper Control of Generation of Code
An issue in Studio 3T v.2025.1.0 and before allows a remote attacker to execute arbitrary code via a crafted payload to the childprocess module...
CVE-2023-27849
rails-routes-to-json v1.0.0 was discovered to contain a remote code execution RCE vulnerability via the childprocess function...
CVE-2021-33360
An issue found in Stoqey gnuplot v.0.0.3 and earlier allows attackers to execute arbitrary code via the src/index.ts, plotCallack, childprocess, and/or filePath parameters...
OS Command Execution
HFS is vulnerable to OS Command Execution. The vulnerability is due to using execSync instead of spawnSync in a childprocess to execute the df shell command, which allows an attacker to execute OS commands remotely via the file upload feature...
CVE-2023-39517: Improper Neutralization of Input During Web Page Generation
Joplin is a free, open source note taking and to-do application. A Cross site scripting XSS vulnerability in affected versions allows clicking on an untrusted image link to execute arbitrary shell commands. The HTML sanitizer packages/renderer/htmlUtils.ts::sanitizeHtml preserves links. However,...
Node.js 18.x < 18.20.2 / 20.x < 20.12.2 / 21.x < 21.7.3 Multiple Vulnerabilities (Wednesday, April 10, 2024 Security Releases).
The version of Node.js installed on the remote host is prior to 18.20.2, 20.12.2, 21.7.3. It is, therefore, affected by multiple vulnerabilities as referenced in the Wednesday, April 10, 2024 Security Releases advisory. - Due to the improper handling of batch files in childprocess.spawn /...
Wednesday, April 10, 2024 Security Releases
Wednesday, April 10, 2024 Security Releases Security releases available Updates are now available for the 18.x, 20.x, 21.x Node.js release lines for the following issues. Command injection via args parameter of childprocess.spawn without shell option enabled on Windows CVE-2024-27980 - HIGH Due t...
CVE-2024-21488
Versions of the package network before 0.7.0 are vulnerable to Arbitrary Command Injection due to use of the childprocess exec function without input sanitization. If attacker-controlled user input is given to the macaddressfor function of the package, it is possible for the attacker to execute...
CVE-2024-21488: Improper Neutralization of Special Elements used in a Command
Versions of the package network before 0.7.0 are vulnerable to Arbitrary Command Injection due to use of the childprocess exec function without input sanitization. If attacker-controlled user input is given to the macaddressfor function of the package, it is possible for the attacker to execute...
CVE-2023-31873
Gin 0.7.4 allows execution of arbitrary code when a crafted file is opened, e.g., via require'childprocess'...
CVE-2023-31873: Undefined Security Weakness
Gin 0.7.4 allows execution of arbitrary code when a crafted file is opened, e.g., via require'childprocess'...
CVE-2023-31874: Incorrect Permission Assignment for Critical Resource
Yank Note YN 3.52.1 allows execution of arbitrary code when a crafted file is opened, e.g., via nodeRequire'childprocess'...
Command Injection
rails-routes-to-json is vulnerable to command injection. The vulnerability exists due to improper input sanitization in the childprocess function, which allows an attacker to inject malicious commands into the system...
GHSA-88QF-5F3V-PM6M Remote code execution in dawnsparks-node-tesseract
dawnsparks-node-tesseract before 0.4.1 was discovered to contain a remote code execution RCE vulnerability via the childprocess function...
Remote code execution in broccoli-compass
broccoli-compass v0.2.4 was discovered to contain a remote code execution RCE vulnerability via the childprocess function...
CVE-2023-27849
rails-routes-to-json v1.0.0 was discovered to contain a remote code execution RCE vulnerability via the childprocess function...
CVE-2023-29566
huedawn-tesseract 0.3.3 and dawnsparks-node-tesseract 0.4.0 to 0.4.1 was discovered to contain a remote code execution RCE vulnerability via the childprocess function...