CVE-2025-64340 FastMCP has a Command Injection vulnerability - Gemini CLI

FastMCP is the standard framework for building MCP applications. Prior to version 3.2.0, server names containing shell metacharacters e.g., & can cause command injection on Windows when passed to fastmcp install claude-code or fastmcp install gemini-cli. These install paths use subprocess.run wit...

CVE-2026-34935: Improper Neutralization of Special Elements used in an OS Command

PraisonAI is a multi-agent teams system. From version 4.5.15 to before version 4.5.69, the --mcp CLI argument is passed directly to shlex.split and forwarded through the call chain to anyio.openprocess with no validation, allowlist check, or sanitization at any hop, allowing arbitrary OS command...

data-pipelines-cli (>=0.31.0, <=0.32.0), pytoil (>=0.36.0, <=0.38.1) potentially affected by CVE-2026-34726 via copier (7.0.1)

copier PYPI version 7.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on copier and may be impacted: - data-pipelines-cli =0.31.0, =0.36.0, =0.38.1 Source cves: CVE-2026-34726 Source advisory: OSV:PYSEC-2026-2134...

entangled-cli (>=2.0.0, <=2.0.2), flet (>=0.10.0, <=0.11.0) +9 more potentially affected by CVE-2026-34730 via copier (8.3.0)

copier PYPI version 8.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on copier and may be impacted: - entangled-cli =2.0.0, =0.10.0, =0.10.0, =0.1.1, =0.1.10, =0.7.1, =0.12.5, =4.1.0b1, =4.3.0b3, =4.1.0b1, =4.1.0b1, =4.3.4rc3 Source cves:...

dialogy (>=0.2.3, <=0.9.20), flexlate-dev (>=0.1.0, <=0.19.0) +2 more potentially affected by CVE-2026-34730 via copier (5.1.0)

copier PYPI version 5.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on copier and may be impacted: - dialogy =0.2.3, =0.1.0, =0.1.0, =0.1.0, =0.2.0 Source cves: CVE-2026-34730 Source advisory: OSV:PYSEC-2026-2135...

data-pipelines-cli (>=0.31.0, <=0.32.0), pytoil (>=0.36.0, <=0.38.1) potentially affected by CVE-2026-34730 via copier (7.0.1)

copier PYPI version 7.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on copier and may be impacted: - data-pipelines-cli =0.31.0, =0.36.0, =0.38.1 Source cves: CVE-2026-34730 Source advisory: OSV:PYSEC-2026-2135...

dialogy (>=0.2.3, <=0.9.20), flexlate-dev (>=0.1.0, <=0.19.0) +2 more potentially affected by CVE-2026-34726 via copier (5.1.0)

copier PYPI version 5.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on copier and may be impacted: - dialogy =0.2.3, =0.1.0, =0.1.0, =0.1.0, =0.2.0 Source cves: CVE-2026-34726 Source advisory: OSV:PYSEC-2026-2134...

GHSA-3HFP-GQGH-XC5G Axios supply chain attack - dependency in @lightdash/cli may resolve to compromised axios versions

Impact A supply chain attack on the axios npm package versions 1.14.1 and 0.30.4 introduced a malicious transitive dependency [email protected] that deploys a cross-platform remote access trojan RAT on macOS, Windows, and Linux. The attacker compromised the primary axios maintainer's npm...

Axios supply chain attack - dependency in @lightdash/cli may resolve to compromised axios versions

Impact A supply chain attack on the axios npm package versions 1.14.1 and 0.30.4 introduced a malicious transitive dependency [email protected] that deploys a cross-platform remote access trojan RAT on macOS, Windows, and Linux. The attacker compromised the primary axios maintainer's npm...

Axios npm Supply Chain Incident Impacting @usebruno/cli

Impact This is a supply chain attack involving compromised versions of the axios npm package, which introduced a hidden dependency deploying a cross-platform Remote Access Trojan RAT. Users of @usebruno/cli who ran npm install between 00:21 UTC and 03:30 UTC on March 31, 2026 may have been...

GHSA-658G-P7JG-WX5G Axios npm Supply Chain Incident Impacting @usebruno/cli

Impact This is a supply chain attack involving compromised versions of the axios npm package, which introduced a hidden dependency deploying a cross-platform Remote Access Trojan RAT. Users of @usebruno/cli who ran npm install between 00:21 UTC and 03:30 UTC on March 31, 2026 may have been...

AARTF---Autonomous-AI-RedTeam-Framework

AARTF AI-Driven Autonomous Security Workflow !CIhttps:/...

MAL-2026-2420 Malicious code in @_wnpm/wnpm-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9729c3c0a6c625f2d6cc79833205a4331647989fa84d85bdd158924af91020fd The package @wnpm/wnpm-cli was found to contain malicious code. Source: ossf-package-analysis...

PT-2026-29908

Impact This is a supply chain attack involving compromised versions of the axios npm package, which introduced a hidden dependency deploying a cross-platform Remote Access Trojan RAT. Users of @usebruno/cli who ran npm install between 00:21 UTC and 03:30 UTC on March 31, 2026 may have been...

PT-2026-32200

Impact A supply chain attack on the axios npm package versions 1.14.1 and 0.30.4 introduced a malicious transitive dependency [email protected] that deploys a cross-platform remote access trojan RAT on macOS, Windows, and Linux. The attacker compromised the primary axios maintainer's npm...

PT-2026-29967

Name of the Vulnerable Software and Affected Versions @usebruno/cli versions installed between 00:21 UTC and 03:30 UTC on March 31, 2026 Description A supply chain attack involving compromised versions of the axios npm package introduced a hidden dependency deploying a cross-platform Remote Acces...

@akashic/akashic-cli (>=2.16.49, <=2.17.21), @akashic/akashic-cli-export (>=1.8.28, <=1.9.17) +251 more potentially affected by CVE-2026-2950 via lodash.unset (>=4.0.2, <=4.5.2)

lodash.unset NPM version =4.0.2, =2.16.49, =1.8.28, =1.2.1, =1.8.4, =8.0.0, =1.0.75, =0.0.2, =0.1.0, =1.31.9, =0.0.4, =0.6.0 and more Source cves: CVE-2026-2950 Source advisory: GHSA-F23M-R3PF-42RH...

CVE-2026-34733

WWBN AVideo is an open source video platform. In versions 26.0 and prior, the AVideo installation script install/deleteSystemdPrivate.php contains a PHP operator precedence bug in its CLI-only access guard. The script is intended to run exclusively from the command line, but the guard condition...

entangled-cli (>=2.0.0, <=2.0.2), flet (>=0.10.0, <=0.11.0) +9 more potentially affected by CVE-2026-34730 via copier (8.3.0)

copier PYPI version 8.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on copier and may be impacted: - entangled-cli =2.0.0, =0.10.0, =0.10.0, =0.1.1, =0.1.10, =0.7.1, =0.12.5, =4.1.0b1, =4.3.0b3, =4.1.0b1, =4.1.0b1, =4.3.4rc3 Source cves:...

dialogy (>=0.2.3, <=0.9.20), flexlate-dev (>=0.1.0, <=0.19.0) +2 more potentially affected by CVE-2026-34730 via copier (5.1.0)

copier PYPI version 5.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on copier and may be impacted: - dialogy =0.2.3, =0.1.0, =0.1.0, =0.1.0, =0.2.0 Source cves: CVE-2026-34730 Source advisory: OSV:GHSA-HGJQ-P8CR-GG4H...