192519 matches found
CVE-2026-110204
Roo Code through 3.54.0 contains a command approval bypass vulnerability that allows attackers to run denied shell commands because parseCommandLine treats $ command; substitutions as parameter expansions. Attackers using indirect prompt injection can embed denied commands inside an allowlisted...
CVE-2026-110202
Roo Code through 3.54.0 contains a command approval bypass vulnerability in getCommandDecision that allows attackers to auto-approve denied shell commands by prefixing them with a bare & redirect. Attackers using indirect prompt injection can make the allowlist match a redirect target like echo...
CVE-2026-110203
Roo Code through 3.54.0 contains a command approval bypass vulnerability that allows attackers to auto-approve denied shell commands by abusing quote-masking regex in parseCommandLine. Attackers can use indirect prompt injection with escaped or single-quoted double quotes to hide command separato...
CVE-2026-109429
Mistral Vibe before 2.25.4 contains a command permission gate bypass vulnerability that allows attackers to execute arbitrary commands by hiding a command substitution inside a single-quoted variable value that tree-sitter-bash static parsing cannot detect. Attackers can craft input such as...
CVE-2026-109428
Mistral Vibe before 2.25.5 contains a permission validation bypass vulnerability that allows attackers to execute unauthorized commands by exploiting a parsing discrepancy between tree-sitter-bash and bash in handling backslash-newline line continuations in the extractcommands function of bash.py...
CVE-2026-110236
KDE Dolphin 24.08.0 through 26.08.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted folder names substituted into the path placeholder. Attackers can embed a double quote and shell metacharacters in a directory name to escape quoting i...
UBUNTU-CVE-2026-110236
KDE Dolphin 24.08.0 through 26.08.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted folder names substituted into the path placeholder. Attackers can embed a double quote and shell metacharacters in a directory name to escape quoting i...
CVE-2026-104584
reNgine up to v2.2.0 and current master branch commit de4199222cca5618f1255930ce78987e47d43a99 is vulnerable to OS Command Injection via the customheaders scan engine configuration field in web/reNgine/tasks.py fetchurl and dirfilefuzz functions...
CVE-2026-100207
Improper neutralization of special elements used in an os command 'os command injection' in Azure CycleCloud allows an authorized attacker to execute code locally...
CVE-2026-86022 VNote: Argument injection to arbitrary command execution via crafted note filename in external-program handling
VNote is a note-taking platform. Prior to 4.3.0, SessionConfig::ExternalProgram::fetchCommand wraps a note path in double quotes and substitutes it into a command string that QProcess::startconst QString& reparses into arguments through ProcessUtils::startDetached. The automatic path in...
CVE-2026-86022
The note-taking platform VNote (prior to version 4.3.0 ) is vulnerable to argument injection leading to arbitrary command execution. The root cause lies in SessionConfig::ExternalProgram::fetchCommand, which wraps a note path in double quotes before passing it to QProcess::start(const QString&) v...
CVE-2026-86022 VNote: Argument injection to arbitrary command execution via crafted note filename in external-program handling
VNote is a note-taking platform. Prior to 4.3.0, SessionConfig::ExternalProgram::fetchCommand wraps a note path in double quotes and substitutes it into a command string that QProcess::startconst QString& reparses into arguments through ProcessUtils::startDetached. The automatic path in...
CVE-2026-86022 VNote: Argument injection to arbitrary command execution via crafted note filename in external-program handling
VNote is a note-taking platform. Prior to 4.3.0, SessionConfig::ExternalProgram::fetchCommand wraps a note path in double quotes and substitutes it into a command string that QProcess::startconst QString& reparses into arguments through ProcessUtils::startDetached. The automatic path in...
EUVD-2026-100523
VNote is a note-taking platform. Prior to 4.3.0, SessionConfig::ExternalProgram::fetchCommand wraps a note path in double quotes and substitutes it into a command string that QProcess::startconst QString& reparses into arguments through ProcessUtils::startDetached. The automatic path in...
CVE-2026-86022
VNote is a note-taking platform. Prior to 4.3.0, SessionConfig::ExternalProgram::fetchCommand wraps a note path in double quotes and substitutes it into a command string that QProcess::startconst QString& reparses into arguments through ProcessUtils::startDetached. The automatic path in...
CVE-2026-55601 MultiTail: Shell injection in execute-on-match command handling
MultiTail is a utility for monitoring multiple log files in one terminal. In version 7.1.5 and earlier, the -ex and -eX execute-on-match feature appended attacker-controlled matched input to a configured command inside double quotes, then checkfilterexec in mt.c passed the constructed command...
CVE-2026-55601
The log monitoring utility MultiTail (version 7.1.5 and earlier ) is vulnerable to a shell injection flaw within its -ex and -eX execute-on-match features. The root cause lies in the check_filter_exec() function in mt.c, which passes a constructed command—containing unsafely escaped attacker-cont...
EUVD-2026-100521
MultiTail is a utility for monitoring multiple log files in one terminal. In version 7.1.5 and earlier, the -ex and -eX execute-on-match feature appended attacker-controlled matched input to a configured command inside double quotes, then checkfilterexec in mt.c passed the constructed command...
CVE-2026-55601
MultiTail is a utility for monitoring multiple log files in one terminal. In version 7.1.5 and earlier, the -ex and -eX execute-on-match feature appended attacker-controlled matched input to a configured command inside double quotes, then checkfilterexec in mt.c passed the constructed command...