GHSA-6VC5-VF29-FFR2 @nx/docker: OS command injection in the @nx/docker release pipeline

Summary The @nx/docker release pipeline builds its docker invocations as shell command strings, interpolating release.docker.repositoryName and registryUrl from Nx configuration into them. Because those strings are handed to /bin/sh -c, a crafted repository or registry name executes as a command...

NPM: Nx: OS command injection via git revisions and remote refs

NPM: Nx: OS command injection via git revisions and remote refs vulnerability discovered by ? in WordPress Npm nx versions = 14.0.0, 22.7.8...

Nx: OS command injection via git revisions and remote refs

Summary Nx core builds several git invocations as shell command strings with untrusted values interpolated into them, so a value that should be a git revision or ref is parsed by /bin/sh instead. Two entry points are reachable by an attacker: affected commands, where defaultBase /...

GHSA-W2VW-W76X-QR89 Nx: OS command injection via git revisions and remote refs

Summary Nx core builds several git invocations as shell command strings with untrusted values interpolated into them, so a value that should be a git revision or ref is parsed by /bin/sh instead. Two entry points are reachable by an attacker: affected commands, where defaultBase /...

Centreon-20.04

CVE-2020-12688 - Centreon 20.04 인증된 RCE minHelpCommand.php 명령 이름 변수 RCE CVE-2020-12688 Centreon 최신 릴리스 문서: https://docs.centreon.com/current/en/releases/centreon-core.html 발견자: TheCyberGeek 발견 날짜: 30/04/2020 공개 날짜: 15/06/2020 사용되지 않는 minHelpCommand.php버전 19.04에서 제거됨를 통한 명령 실행. 제거된 함수는 로그인한 사용자가 접...

CVE-2025-69212_PoC

CVE-2025-69212: OpenSTAManager 개념 증명PoC 이 저장소는 OpenSTAManager 내에서 CVE-2025-69212 로 식별된 취약점을 입증하는 개념 증명PoC을 포함하고 있습니다. 이는 P7M서명된 XML 파일 디코딩 기능으로 인해 발생하는 OS 명령 주입 취약점입니다. 영향을 받는 버전은 2.9.8 및 이전 버전입니다. 설명 CVE-2025-69212는 OpenSTAManager에서 발견된 보안 취약점입니다. 이 PoC는 교육 목적, 보안 연구, 패치 확인을 위해 취약점의 메커니즘을 설명하기 위...

VulnerableSpringDataRest

취약한 Spring DataRest 애플리케이션 이것은 의도적으로 취약하게 만든 Spring Data REST 애플리케이션으로, CVE-2017-8046 취약점과 REST API를 통한 명령 주입 및 원격 코드 실행 테스트의 어려움을 테스트하고 시연하기 위한 것입니다. Swagger UI를 지원하므로 Swagger 문서가 검색 및 스파이더링에 도움이 되는 도구예: OWASP Zend Attack Proxy ZAP의 Swagger 플러그인와 함께 사용할 수 있습니다. 사용 방법: 저장소를 로컬에 클론합니다. Maven을 사용하여...

CVE-2026-9277

CVE-2026-9277 - Shell-Quote コマンドインジェクションエクスプロイト shell-quote ライブラリのレガシーバージョン（= 1.8.3）に存在する構造的コマンドインジェクションの脆弱性である CVE-2026-9277 を検証および実証するために設計された、専用の Proof of Concept（PoC）エクスプロイトスクリプトです。 本スキャナは、入力された JSON...

codeql-workshop

CodeQL로 취약점 찾기 원작 워크숍: Sylwia Budzynska 사전 준비사항 • 자료 • 워크숍 대상 : 보안 엔지니어, 보안 연구자, 개발자. 배울 내용 : CodeQL을 사용하여 코드 탐색 및 보안 문제를 찾는 방법을 배웁니다. 만들어볼 것 : 보안 권고를 기반으로 Command Injection을 찾는 CodeQL 쿼리를 작성합니다. 📣 사전 준비사항 두 가지 옵션 중 하나를 선택하여 워크숍 실습을 진행할 수 있습니다: 옵션 A: 로컬 설치 VS Code 사용 - CodeQL이 로컬 머신에서 실행됩니다 옵션 B:...

Hack-The-Box-Enigma-Findings-Report

🛡️ Hack The Box - Enigma 연구 결과 보고서 📋 개요 이 저장소는 Hack The Box 머신 Enigma에 대한 종합적인 침투 테스트 보고서를 포함합니다. 🔍 주요 발견 사항 안전하지 않은 NFS 공유로 온보딩 문서 노출 - 중간 심각도 암호화되지 않은 이메일 콘텐츠를 통한 내부 자격 증명 노출 - 중간 심각도 직원 IMAPS 계정 간 비밀번호 재사용 - 높은 심각도 OpenSTAManager 인증된 OS 명령 주입 CVE-2025-69212 - 치명적 심각도 웹 애플리케이션 구성의 평문 데이터베이스 자격 증...

CVE-2026-105767

Improper Neutralization of Special Elements used in an OS Command in the integrate-platform-docs composite GitHub Action of Chainguard Academy edu from commit 7375a80caabcc31c33ec90f29687ed78c13d16ff before commit fb0efb2537d326ab18c07d620875b8ed2a4b39f3 allows an actor who controls the projectid...

CVE-2026-105691

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the SVG exporter places an attacker-controlled text object's fill-color value into a ppmcolormask command string and executes that string through childprocess.exec. A user who can edit a file can store shell metacharacters...

CVE-2026-105697

Langflow versions prior to 1.10.3 are vulnerable to OS command injection due to a lack of allowlisting in the MCP stdio transport configuration. An attacker capable of accessing MCP server settings or using the MCP Tools component can execute arbitrary OS commands (e.g., rm -rf, reverse shells) o...

CVE-2026-105697 Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration

Langflow is a tool for building and deploying AI-powered agents and workflows. Before Langflow 1.10.3, the MCP stdio transport launched whatever command / args a user put in an MCP server configuration, with no allowlist and before 1.10.3 wrapped in bash -c "exec command ...". Any user able to...

CVE-2026-105697 Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration

Langflow is a tool for building and deploying AI-powered agents and workflows. Before Langflow 1.10.3, the MCP stdio transport launched whatever command / args a user put in an MCP server configuration, with no allowlist and before 1.10.3 wrapped in bash -c "exec command ...". Any user able to...

CVE-2026-105697 Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration

Langflow is a tool for building and deploying AI-powered agents and workflows. Before Langflow 1.10.3, the MCP stdio transport launched whatever command / args a user put in an MCP server configuration, with no allowlist and before 1.10.3 wrapped in bash -c "exec command ...". Any user able to...

CVE-2026-105691 Penpot: Authenticated OS Command Injection in Penpot SVG Exporter via Legacy fill-color

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the SVG exporter places an attacker-controlled text object's fill-color value into a ppmcolormask command string and executes that string through childprocess.exec. A user who can edit a file can store shell metacharacters...

CVE-2026-105691 Penpot: Authenticated OS Command Injection in Penpot SVG Exporter via Legacy fill-color

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the SVG exporter places an attacker-controlled text object's fill-color value into a ppmcolormask command string and executes that string through childprocess.exec. A user who can edit a file can store shell metacharacters...

CVE-2026-105691

The open-source design platform Penpot contains an OS Command Injection vulnerability in its SVG exporter affecting versions prior to 2.18.0 . The root cause is the unsafely handling of an attacker-controlled fill-color value from a text object, which is placed into a ppmcolormask command string ...

CVE-2026-105691 Penpot: Authenticated OS Command Injection in Penpot SVG Exporter via Legacy fill-color

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the SVG exporter places an attacker-controlled text object's fill-color value into a ppmcolormask command string and executes that string through childprocess.exec. A user who can edit a file can store shell metacharacters...