@ekairos/cli (>=1.22.35, <=1.22.100-beta.development.0), @ekairos/context (1.22.102-beta.feature-lab-task-sandbox-beta.0) +31 more potentially affected by CVE-2026-42570 via devalue (5.6.3)

devalue NPM version 5.6.3 is affected by a known vulnerability. The following packages have a transitive dependency on devalue and may be impacted: - @ekairos/cli =1.22.35, =1.21.52-beta.0, =1.22.9-beta.development.0, =1.22.13-beta.development.0, =1.22.39, =1.22.11-beta.development.0,...

CVE-2026-45369 python-utcp: Command Injection via Unsanitized Argument Substitution in CLI Communication Protocol

python-utcp is the python implementation of UTCP. Prior to 1.1.3, the substituteutcpargs method in clicommunicationprotocol.py inserts user-controlled toolargs values directly into shell command strings without any sanitization or escaping. These commands are then executed via /bin/bash -c Unix o...

CVE-2026-45369

Summary: CVE-2026-45369 affects python-utcp prior to 1.1.3, where _substitute_utcp_args in cli_communication_protocol.py injects user-controlled tool_args directly into shell commands without sanitization, leading to potential Remote Code Execution when commands are run via /bin/bash -c (Unix) or...

CVE-2026-45370 python-utcp: Full Process Environment Exposed to CLI Subprocess - Secrets Leakage via Command Injection

python-utcp is the python implementation of UTCP. Prior to 1.1.3, prepareenvironment in clicommunicationprotocol.py passes a full copy of os.environ to every CLI subprocess. When combined with CVE-2026-45369, an attacker can exfiltrate all process-level secrets in a single tool call. This...

WS-2020-0441

In zenn-cli in versions 0.1.36 to 0.1.39 is vulnerable to path traversal, it allows the attacker to read arbitrary .md files...

@hashgraph/stablecoin-npm-cli (>=2.0.0, <=4.4.0), @hashgraph/stablecoin-npm-contracts (>=2.0.0, <=4.4.0) +2 more potentially affected by unknown CVE via commit-msg (0.2.3)

commit-msg NPM version 0.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on commit-msg and may be impacted: - @hashgraph/stablecoin-npm-cli =2.0.0, =2.0.0, =2.0.0, =0.1.0, =0.2.1 Source cves: unknown CVE Source advisory: MEND:WS-2020-0436...

@apsis/cli (0.5.0), @asmallstudio/utilities (>=0.2.2, <=0.3.3) +69 more potentially affected by unknown CVE via git-promise (>=0.2.0, <=0.3.1)

git-promise NPM version =0.2.0, =0.2.2, =1.1.8, =7.2.3-beta.3, =7.0.0, =1.0.0, =5.9.2, =1.1.1, =1.0.4, =0.1.0, =0.1.0, =0.3.1 - bilberry 0.3.0 and more Source cves: unknown CVE Source advisory: MEND:WS-2019-0600...

GHSA-XPWW-F6PM-CFHQ dbt MCP Server has an Argument Injection in dbt CLI Tool Wrappers via node_selection and resource_type Parameters

Discovered through manual source code review. Verified by PoC execution against a local dbt-mcp v1.15.1 installation. Summary rundbtcommand in src/dbtmcp/dbtcli/tools.py constructs the dbt subprocess argument list by appending user-supplied MCP tool parameters without sanitization. Two independen...

@apostrophecms/cli: Command Injection in apos create via Unsanitized Password Input

Summary The @apostrophecms/cli package contains a command injection vulnerability in the apos create command. User-supplied input from the password prompt is embedded directly into a shell command without proper sanitization or escaping. This allows execution of arbitrary commands on the host...

WS-2020-0188

In the affected versions, the AWS Encryption CLI operated in "discovery mode" even when "strict mode" was specified. Although decryption only succeeded if the user had permission to decrypt with at least one of the CMKs, decryption could be successful using a CMK that was not included in the...

AutoPentest-Framework

AutoPentest Framework A modular Automated Penetration Testing...

WS-2019-0388

Angluar-cli is a malicious package that is designed to take advantage of users making a mistake when typing the name of a module to install. When installed the package attempts to remove files and stop processes related to McAfee antivirus on macOS...

@absa-subatomic/openshift-api (>=0.0.1, <=0.0.2), @atomist-seeds/automation-client (>=1.0.0-atomist-update-1.0.0-M.5a-1538147067873.20180928150441, <=1.0.0-master.20180928151025) +40 more potentially affected by unknown CVE via graphql-code-generator (>=0.5.5, <=0.17.0)

graphql-code-generator NPM version =0.5.5, =0.0.1, =1.0.0-atomist-update-1.0.0-M.5a-1538147067873.20180928150441, =1.0.0-atomist-update-1.0.0-M.5a-1538146868055.20180928150114, =1.0.0-atomist-update-1.0.0-M.5a-1538147121196.20180928150530, =0.1.0-master.20181019173228,...

WS-2019-0057

All versions of sequelize-cli are vulnerable to Sensitive Data Exposure. The function filteredURL does not properly sanitize the config.password value which may cause passwords with special characters to be logged in plain text...

@apifie/node-microservice (>=0.0.1, <=1.0.3), @conversationai/moderator-backend-api (>=1.0.0, <=1.0.6) +100 more potentially affected by unknown CVE via sequelize-cli (>=1.2.0, <=5.4.0)

sequelize-cli NPM version =1.2.0, =0.0.1, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.1, =1.0.0, =1.0.0-beta.1, =2.2.1, =3.1.5, =0.0.10, =0.0.6, =0.0.1, =1.1.7, =1.1.12 and more Source cves: unknown CVE Source advisory: MEND:WS-2019-0057...

Fortinet FortiAP Command Execution

The vulnerability of the command-line interface CLI of Fortinet’s FortiAP and FortiAP-W2 microprogramming solutions lies in the lack of measures taken to neutralize the special elements used in operating system commands. Exploiting this vulnerability allows an attacker to execute arbitrary comman...

CVE-2026-0261

Multiple command injection vulnerabilities in Palo Alto Networks PAN-OS® software enable an authenticated administrator to bypass system restrictions and run arbitrary commands as a root user. To be able to exploit this issue, the user must have access to the PAN-OS CLI or Web UI. The security ri...

@accordproject/cicero-cli (>=0.23.0-20220318211856, <=0.24.1-20231019080841), @accordproject/cicero-core (>=0.23.0-20220318211856, <=0.24.1-20230627140514) +172 more potentially affected by CVE-2026-44005 via vm2 (>=3.9.6, <=3.10.5)

vm2 NPM version =3.9.6, =0.23.0-20220318211856, =0.23.0-20220318211856, =0.23.0-20220318211856, =0.23.0-20220318211856, =0.23.0-20220318211856, =0.23.0-20220317205016, =0.23.0-20220317205016, =0.23.0-20220317205016, =0.1.0, =2.1.1, =0.1.1, =1.0.0, =0.1.0, =0.0.2, =1.0.2, =3.0.34 and more Source...

@accordproject/cicero-cli (>=0.3.4, <=0.24.1-20231019080841), @accordproject/cicero-core (>=0.12.5-20190619040852, <=0.24.1-20230627140514) +286 more potentially affected by CVE-2026-45411 via vm2 (>=1.0.1, <=3.11.2)

vm2 NPM version =1.0.1, =0.3.4, =0.12.5-20190619040852, =0.3.12-20180525105709, =0.3.4, =0.11.2-20190326183124, =0.22.2-20210714131804, =0.0.51-20180524154814, =0.0.51-20180524154814, =0.7.4-20190326150718, =2.0.0-rc.8.0.29, =0.1.0, =2.1.1, =0.1.1, =1.0.0, =1.4.0 and more Source cves:...

@accordproject/cicero-cli (>=0.3.4, <=0.24.1-20231019080841), @accordproject/cicero-core (>=0.12.5-20190619040852, <=0.24.1-20230627140514) +285 more potentially affected by CVE-2026-44003 via vm2 (>=1.0.1, <=3.10.5)

vm2 NPM version =1.0.1, =0.3.4, =0.12.5-20190619040852, =0.3.12-20180525105709, =0.3.4, =0.11.2-20190326183124, =0.22.2-20210714131804, =0.0.51-20180524154814, =0.0.51-20180524154814, =0.7.4-20190326150718, =2.0.0-rc.8.0.29, =0.1.0, =2.1.1, =0.1.1, =1.0.0, =1.4.0 and more Source cves:...