@13w/local-rag (2.0.0), @apekshik/grok-cli-apek (>=0.1.5, <=0.1.6) +32 more potentially affected by unknown CVE via @google/gemini-cli (>=0.1.17, <=0.39.0-nightly.20260411.0957f7d3e)

@google/gemini-cli NPM version =0.1.17, =0.1.5, =0.1.0, =1.0.0, =0.0.17, =0.6.4, =0.0.1, =1.3.0, =0.1.4, =0.1.10, =1.0.0, =2.0.0 and more Source cves: unknown CVE Source advisory: SNYK:JS-GOOGLEGEMINICLI-16301693...

Command Injection

Overview @google/gemini-cli is a Gemini CLI Affected versions of this package are vulnerable to Command Injection via the processing of untrusted workspace folders in headless mode and the handling of tool allowlisting under --yolo mode. An attacker can execute arbitrary code by submitting...

GHSA-WPQR-6V78-JR5G Gemini CLI: Remote Code Execution via workspace trust and tool allowlisting bypasses

Summary Gemini CLI @google/gemini-cli and the run-gemini-cli GitHub Action are being updated to harden workspace trust and tool allowlisting, in particular when used in untrusted environments like GitHub Actions. This update introduces a breaking change to how non-interactive headless environment...

@13w/local-rag (2.0.0), @apekshik/grok-cli-apek (>=0.1.5, <=0.1.6) +32 more potentially affected by CVE-2026-12537 via @google/gemini-cli (>=0.1.17, <=0.39.0-nightly.20260411.0957f7d3e)

@google/gemini-cli NPM version =0.1.17, =0.1.5, =0.1.0, =1.0.0, =0.0.17, =0.6.4, =0.0.1, =1.3.0, =0.1.4, =0.1.10, =1.0.0, =2.0.0 and more Source cves: CVE-2026-12537 Source advisory: OSV:GHSA-WPQR-6V78-JR5G...

Gemini CLI: Remote Code Execution via workspace trust and tool allowlisting bypasses

Summary Gemini CLI @google/gemini-cli and the run-gemini-cli GitHub Action are being updated to harden workspace trust and tool allowlisting, in particular when used in untrusted environments like GitHub Actions. This update introduces a breaking change to how non-interactive headless environment...

aztarna (1.0.0), gluetool (>=1.25.0, <=1.26.0) +4 more potentially affected by CVE-2026-41066 via lxml (4.2.4)

lxml PYPI version 4.2.4 is affected by a known vulnerability. The following packages have a transitive dependency on lxml and may be impacted: - aztarna 1.0.0 - gluetool =1.25.0, =1.0.0, =1.0.0, =0.4.1, =1.4.0, =1.5.2 Source cves: CVE-2026-41066 Source advisory: OSV:PYSEC-2026-87...

@netlify/agent-runner-cli (>=1.83.1, <=1.94.0), feishu-claude-bot (0.1.0) +1 more potentially affected by CVE-2026-40068 via @anthropic-ai/claude-code (>=2.1.63, <=2.1.81)

@anthropic-ai/claude-code NPM version =2.1.63, =1.83.1, =1.2.2, =1.2.3 Source cves: CVE-2026-40068 Source advisory: OSV:GHSA-Q5HJ-MXQH-VV77...

@netlify/agent-runner-cli (>=1.83.1, <=1.94.0), feishu-claude-bot (0.1.0) +1 more potentially affected by CVE-2026-40068 via @anthropic-ai/claude-code (>=2.1.63, <=2.1.81)

@anthropic-ai/claude-code NPM version =2.1.63, =1.83.1, =1.2.2, =1.2.3 Source cves: CVE-2026-40068 Source advisory: SNYK:JS-ANTHROPICAICLAUDECODE-16301567...

PT-2026-89304

Name of the Vulnerable Software and Affected Versions @google/gemini-cli versions prior to 0.39.1 run-gemini-cli GitHub Action affected versions not specified Description An issue in the Gemini CLI and the associated GitHub Action allows an unprivileged attacker to achieve arbitrary code executio...

PT-2026-51788

Name of the Vulnerable Software and Affected Versions Google Gemini CLI versions prior to 0.39.1 run-gemini-cli GitHub Action versions prior to 0.1.22 Description An OS command injection flaw exists in the container launcher used by Google Gemini CLI and the run-gemini-cli GitHub Action when...

PT-2026-37208

Name of the Vulnerable Software and Affected Versions @google/gemini-cli versions prior to 0.39.1 run-gemini-cli affected versions not specified Description Issues exist in the handling of workspace trust and tool allowlisting when running in headless mode, such as within CI/CD environments. In...

CVE-2026-41247 elFinder: Command injection in resize background color parameter when using ImageMagick CLI

elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.67, elFinder contains a command injection vulnerability in the resize command. The bg background color parameter is accepted from user input and passed through image resize/rotate processing. In...

CVE-2026-41247 elFinder: Command injection in resize background color parameter when using ImageMagick CLI

elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.67, elFinder contains a command injection vulnerability in the resize command. The bg background color parameter is accepted from user input and passed through image resize/rotate processing. In...

Malicious code in @bitwarden/cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c6fb2336936a86f37fc2018f8e68dc9989ffc3e79aa23297bf470de178201f50 The package @bitwarden/cli was found to contain malicious code. Source: ghsa-malware 8a8c7958926d5ec3795102e9114dfaa649ae3160afb9159ec2c46f044018b776...

MAL-2026-3020 Malicious code in @bitwarden/cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c6fb2336936a86f37fc2018f8e68dc9989ffc3e79aa23297bf470de178201f50 The package @bitwarden/cli was found to contain malicious code. Source: ghsa-malware 8a8c7958926d5ec3795102e9114dfaa649ae3160afb9159ec2c46f044018b776...

Malicious code in changelog-cli-logger (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 98a1e229322241da9d146f6aad5c96de566b2707088406fd7de40cbb69445023 The package changelog-cli-logger was found to contain malicious code. Source: ghsa-malware...

Exploit for Path Traversal in Jenkins

jenkinsscan Find jenkins environment and checks for CVE-2024-...

CVE-2026-41247: Improper Neutralization of Special Elements used in an OS Command

elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.67, elFinder contains a command injection vulnerability in the resize command. The bg background color parameter is accepted from user input and passed through image resize/rotate processing. In...

Embedded Malicious Code

Overview @bitwarden/cli is an A secure and free password manager for all of your devices. Affected versions of this package are vulnerable to Embedded Malicious Code included in a compromised release that is suspected to be part of the Checkmarx April compromise. The payload is delivered via...

@marko/compiler (5.0.0-next.0), @marko/translator-default (5.0.0-next.0) +4 more potentially affected by CVE-2026-41591 via marko (>=5.0.0-next.0, <=5.21.7)

marko NPM version =5.0.0-next.0, =2.9.2, =1.15.0, =1.1.4, =1.2.1 Source cves: CVE-2026-41591 Source advisory: OSV:GHSA-X9FJ-57FH-C8WQ...