37 matches found
CVE-2026-101102
A vulnerability was found in deepseek-ai deepseek-harness up to 0.1.0-rc.7. Impacted is the function runcode of the component Code Mode Sandbox. The manipulation results in sandbox issue. The attack can be executed remotely. The vendor's own code, SAFETY.md, and design notes all explicitly state...
CVE-2026-101102 deepseek-ai deepseek-harness Code Mode Sandbox run_code sandbox
A vulnerability was found in deepseek-ai deepseek-harness up to 0.1.0-rc.7. Impacted is the function runcode of the component Code Mode Sandbox. The manipulation results in sandbox issue. The attack can be executed remotely. The vendor's own code, SAFETY.md, and design notes all explicitly state...
CVE-2026-101102
A vulnerability exists in deepseek-ai deepseek-harness (versions up to 0.1.0-rc.7 ) within the Code Mode Sandbox component. Specifically, the run_code function is susceptible to manipulation, leading to a sandbox issue that can be triggered via a remote attack . Notably, the vendor's own document...
EUVD-2026-88402
A vulnerability was found in deepseek-ai deepseek-harness up to 0.1.0-rc.7. Impacted is the function runcode of the component Code Mode Sandbox. The manipulation results in sandbox issue. The attack can be executed remotely. The vendor's own code, SAFETY.md, and design notes all explicitly state...
CVE-2026-101102 deepseek-ai deepseek-harness Code Mode Sandbox run_code sandbox
A vulnerability was found in deepseek-ai deepseek-harness up to 0.1.0-rc.7. Impacted is the function runcode of the component Code Mode Sandbox. The manipulation results in sandbox issue. The attack can be executed remotely. The vendor's own code, SAFETY.md, and design notes all explicitly state...
CVE-2026-101102: Undefined Security Weakness
A vulnerability was found in deepseek-ai deepseek-harness up to 0.1.0-rc.7. Impacted is the function runcode of the component Code Mode Sandbox. The manipulation results in sandbox issue. The attack can be executed remotely. The vendor's own code, SAFETY.md, and design notes all explicitly state...
PT-2026-102287
Name of the Vulnerable Software and Affected Versions deepseek-ai deepseek-harness versions prior to 0.1.0-rc.8 Description A remote attack can cause a sandbox issue within the Code Mode Sandbox component by manipulating the run code function. The vendor has noted that the worker is intended for...
Arbitrary Code Injection
Overview praisonai is a PraisonAI TypeScript AI Agents Framework - Node.js, npm, and Javascript AI Agents Framework Affected versions of this package are vulnerable to Arbitrary Code Injection via the codeMode process. An attacker can execute arbitrary code on the host system by bypassing the...
GHSA-P69M-4F92-2V84 PraisonAI: Remote Code Execution via Sandbox Escape in `codeMode` Tool
Summary The codeMode tool in src/praisonai-ts/src/tools/builtins/code-mode.ts uses new Function with a withsandbox pattern to execute LLM-generated code. The blocklist-based "sandbox" can be trivially bypassed via Function'return this' to recover the global object, followed by global.require with...
PraisonAI: Remote Code Execution via Sandbox Escape in `codeMode` Tool
Summary The codeMode tool in src/praisonai-ts/src/tools/builtins/code-mode.ts uses new Function with a withsandbox pattern to execute LLM-generated code. The blocklist-based "sandbox" can be trivially bypassed via Function'return this' to recover the global object, followed by global.require with...
NPM: npm PraisonAI codeMode sandbox escape via Function constructor
NPM: npm PraisonAI codeMode sandbox escape via Function constructor vulnerability discovered by ? in WordPress Npm praisonai versions = 1.4.0, = 1.7.1...
GHSA-VMMJ-PFW7-FJWP npm PraisonAI codeMode sandbox escape via Function constructor
Summary The published npm package praisonai exports a TypeScript built-in tool named codeMode. The package describes this tool as executing code in a sandboxed environment, marks its capability as sandbox: true, and registers it through the public tools facade. The implementation does not create ...
PT-2026-53144
Summary The codeMode tool in src/praisonai-ts/src/tools/builtins/code-mode.ts uses new Function with a withsandbox pattern to execute LLM-generated code. The blocklist-based "sandbox" can be trivially bypassed via Function'return this' to recover the global object, followed by global.require with...
PT-2026-61795
Name of the Vulnerable Software and Affected Versions PraisonAI versions prior to 1.7.2 Description The codeMode tool in src/praisonai-ts/src/tools/builtins/code-mode.ts executes model-generated JavaScript using new Function and a withsandbox pattern. The implementation relies on a...
EUVD-2020-19700
Malware in sbrugna...
CVE-2020-27176
Mutation XSS exists in Mark Text through 0.16.2 that leads to Remote Code Execution. NOTE: this might be considered a duplicate of CVE-2020-26870; however, it can also be considered an issue in the design of the "source code mode" feature, which parses HTML even though HTML support is not one of...
Cross Site Scripting(XSS)
summernote is vulnerable to Cross Site Scripting XSS. The vulnerability is due to insufficient input validation and sanitization of user-provided content, allowing malicious scripts to be executed within the context of the application when viewed in code mode...
CVE-2023-51246
A Cross Site Scripting XSS vulnerability in GetSimple CMS 3.3.16 exists when using Source Code Mode as a backend user to add articles via the /admin/edit.php page...
