39 matches found
CVE-2026-82584 Terminal escape sequence injection in the mix igniter.install confirmation prompt via package metadata
Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in ash-project igniter allows a malicious package publisher to forge the mix igniter.install confirmation prompt. mix igniter.install prints a confirmation panel an anti-typosquatting safeguard listing a package's hex...
EEF-CVE-2026-82584 Terminal escape sequence injection in the mix igniter.install confirmation prompt via package metadata
Summary Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in ash-project igniter allows a malicious package publisher to forge the mix igniter.install confirmation prompt. mix igniter.install prints a confirmation panel an anti-typosquatting safeguard listing a package's...
CVE-2026-82584
ash-project igniter (an Elixir build tool) is vulnerable to terminal escape sequence injection in its mix igniter.install confirmation panel. The panel builder in Igniter.Project.Deps wrote publisher-controlled fields (meta.description, owner usernames, requirement names, version) to the terminal...
CVE-2026-82584 Terminal escape sequence injection in the mix igniter.install confirmation prompt via package metadata
Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in ash-project igniter allows a malicious package publisher to forge the mix igniter.install confirmation prompt. mix igniter.install prints a confirmation panel an anti-typosquatting safeguard listing a package's hex...
CVE-2026-26927
Szafir SDK Web is a browser plug-in that can run SzafirHost application which download the necessary files when launched. In Szafir SDK Web it is possible to change the URL HTTP Origin of the application call location. An unauthenticated attacker can craft a website that is able to launch...
CVE-2026-26927
Szafir SDK Web is a browser plug-in that can run SzafirHost application which download the necessary files when launched. In Szafir SDK Web it is possible to change the URL HTTP Origin of the application call location. An unauthenticated attacker can craft a website that is able to launch...
PT-2026-29741
Szafir SDK Web is a browser plug-in that can run SzafirHost application which download the necessary files when launched. In Szafir SDK Web it is possible to change the URL HTTP Origin of the application call location. An unauthenticated attacker can craft a website that is able to launch...
Exploit for Code Injection in Anthropic Claude_Code
Claude Code: MCP Tool Confirmation Prompt Misrepresentation !...
Exploit for Code Injection in Anthropic Claude_Code
CVE-PENDING: MCP Tool Confirmation Prompt Misrepresentation in...
CVE-2026-26320 OpenClaw macOS deep link confirmation truncation can conceal executed agent message
OpenClaw is a personal AI assistant. OpenClaw macOS desktop client registers the openclaw:// URL scheme. For openclaw://agent deep links without an unattended key, the app shows a confirmation dialog that previously displayed only the first 240 characters of the message, but executed the full...
CVE-2026-26320 OpenClaw macOS deep link confirmation truncation can conceal executed agent message
OpenClaw is a personal AI assistant. OpenClaw macOS desktop client registers the openclaw:// URL scheme. For openclaw://agent deep links without an unattended key, the app shows a confirmation dialog that previously displayed only the first 240 characters of the message, but executed the full...
GHSA-QGQW-H4XQ-7W8W Claude Code has a Command Injection in find Command Bypasses User Approval Prompt
Due to an error in command parsing, it was possible to bypass the Claude Code confirmation prompt to trigger execution of untrusted commands through the find command. Reliably exploiting this required the ability to add untrusted content into a Claude Code context window. Users on standard Claude...
Improper Input Validation
@anthropic-ai/claude-code is vulnerable to Improper Input Validation. The vulnerability is due to an error in command parsing that allows an attacker to bypass the confirmation prompt and trigger execution of untrusted commands by injecting malicious content into a Claude Code context window...
EUVD-2019-18162
Malware in sbrugna...
EUVD-2025-7442
Malicious code in bioql PyPI...
CVE-2025-58764
Summary for CVE-2025-58764 (Claude Code): A command-parsing error in Claude Code allowed bypassing the confirmation prompt and executing an untrusted command when an attacker can inject untrusted content into a Claude Code context window. This affects versions prior to 1.0.105. Exploitation requi...
PT-2025-37055
Name of the Vulnerable Software and Affected Versions: Claude Code versions prior to 1.0.105 Description: Claude Code is an agentic coding tool. A flaw in command parsing allowed a bypass of the Claude Code confirmation prompt, potentially triggering the execution of untrusted commands...
PT-2025-31835
Name of the Vulnerable Software and Affected Versions Claude Code versions prior to 1.0.20 Claude Code versions prior to 1.0.24 Description Claude Code is an agentic coding tool. An error in command parsing allows bypassing the confirmation prompt, leading to the execution of untrusted commands...
CVE-2023-41057
hyper-bump-it is a command line tool for updating the version in project files.hyper-bump-it reads a file glob pattern from the configuration file. That is combined with the project root directory to construct a full glob pattern that is used to find files that should be edited. These matched fil...