59000 matches found
CVE-2026-85623 goose 1.37.0 Arbitrary Command Execution via Recipe Extensions
goose 1.37.0 executes arbitrary commands from recipe stdio extensions and retry.checks without security inspection. Attackers can distribute malicious recipes that execute shell commands as the user running goose, bypassing the recipe security scan which does not inspect extensions or retry...
EUVD-2026-71230
goose 1.37.0 executes arbitrary commands from recipe stdio extensions and retry.checks without security inspection. Attackers can distribute malicious recipes that execute shell commands as the user running goose, bypassing the recipe security scan which does not inspect extensions or retry...
CVE-2026-85623 goose 1.37.0 Arbitrary Command Execution via Recipe Extensions
goose 1.37.0 executes arbitrary commands from recipe stdio extensions and retry.checks without security inspection. Attackers can distribute malicious recipes that execute shell commands as the user running goose, bypassing the recipe security scan which does not inspect extensions or retry...
CVE-2026-85623
goose v1.37.0 (by aaif-goose) contains an arbitrary command execution flaw in its recipe subsystem. The vulnerable components are stdio extensions and retry.checks within recipes, which are executed without passing through the recipe security scan—creating a bypass for attackers who distribute ma...
EUVD-2026-71029
OpenPanel before 2.3.0 fails to properly validate chart formula expressions, allowing authenticated project members with read access to execute arbitrary code by recovering the native JavaScript Function constructor through mathjs matrix objects. Attackers can use the recovered constructor to loa...
Exploit for CVE-2024-36057
CVE-2024-36057 — Koha Library Software CVE ID: CVE-2024-3...
Malicious code in d4rk0nm3 (npm)
Source: ossf-package-analysis fcd44fdf07755c2f5060eee6df68679af14c7bd6185b52853041856db638c7da The OpenSSF Package Analysis project identified 'd4rk0nm3' @ 1.0.6 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity. - Th...
Malicious code in cx-api-client-lite (npm)
Source: ossf-package-analysis 315d3186e692fd6934de0d66c25255e03eb763a15daa0785e92e58a2abbbba60 The OpenSSF Package Analysis project identified 'cx-api-client-lite' @ 200.0.1 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious...
Malicious code in cx-web-themes (npm)
Source: ossf-package-analysis 4311da313c4de72f9e25c5c573ce6a9ebe1bd2cb1c24d5b37af1e4e6d23717ab The OpenSSF Package Analysis project identified 'cx-web-themes' @ 200.0.1 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activit...
Malicious code in create-response (npm)
Source: amazon-inspector 242fbf21e70f13fac07ad9415ae43d91bc17823a931c07c5143ae7f7119a2b24 The package create-response was found to contain malicious code. Source: ossf-package-analysis b8722abdd0b5d5d250eaab2906135a9b8678690501e522f8d6b9fe267ffdf900 The OpenSSF Package Analysis project identified...
Malicious code in cra-docs (npm)
Source: ossf-package-analysis e49ccaa79a7296b7f1237beb3210cabf6610aab5c68e2c349b1fff4d3b2bb332 The OpenSSF Package Analysis project identified 'cra-docs' @ 7.999.45 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity. -...
Malicious code in cpr-mfe (npm)
This package is considered malicious because it communicates with a domain associated with malicious activity and the package executes one or more commands associated with malicious behavior. --- Credit: OpenSSF source...
Malicious code in comet-chat-react-ui-kit (npm)
Source: ossf-package-analysis 9a6f38c4d9dd2413e237c8d146d5fcf11d04f613910b552a32a52b3e4cf199f6 The OpenSSF Package Analysis project identified 'comet-chat-react-ui-kit' @ 1.0.1 npm as malicious. It is considered malicious because: - The package executes one or more commands associated with...
Malicious code in cloudflare-agent-starter (npm)
Source: ossf-package-analysis 073c16b7f6f9d6ba8d94458e7efa756a07cfcc78cefbda3ed218097358812980 The OpenSSF Package Analysis project identified 'cloudflare-agent-starter' @ 99.99.99 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with...
Malicious code in chia-dev-guides (npm)
The package communicates with a domain associated with malicious activity. Source: ossf-package-analysis 346392e0fae6d3a254175cbf00c6b2ebbac781151d1eb9fe24079457e807b317 The OpenSSF Package Analysis project identified 'chia-dev-guides' @ 1.1.3 npm as malicious. It is considered malicious because:...
Malicious code in chain00x_rce (npm)
Source: ossf-package-analysis 3f3656f34947ab9c7e747961055e3697ca5d51e275e42ca7fae5ab01f1c2e7ef The OpenSSF Package Analysis project identified 'chain00xrce' @ 1.0.1 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity. -...
Malicious code in castorama.pl (npm)
Source: ossf-package-analysis 730bed67861cb1d30e187eb40b957257e8395b86e8a9e255005ba3b808369878 The OpenSSF Package Analysis project identified 'castorama.pl' @ 1.0.0 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity. ...
Malicious code in careform (npm)
Source: ossf-package-analysis d7248630d858215437792791bab0fa4a0e67e7a614e29fe427c829e371c5a5bc The OpenSSF Package Analysis project identified 'careform' @ 1.0.0 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity. - Th...
Malicious code in 2nestjs (npm)
Source: amazon-inspector c9471c1fdd6ae99da48e44b8588f9e36814ce2859f2d25641b06cc53cf42174d The package's postinstall hook executes index.js, which enumerates process.env, filters keys matching /^SECRET|API|TOKEN|KEY/, JSON-serializes the matched values, and writes them over a raw TCP socket to the...