Flowise-RCE-CVE-2025-59528

CVE-2025-59528 — Flowise AI Esecuzione Remota di Codice autenticata RCE Panoramica ID CVE: CVE-2025-59528 Software interessato: Flowise AI Versioni vulnerabili: = 3.0.4 Versione corretta: 3.0.5 e successive Gravità: Critica Autore: r3nsi15 Data: 2025 Descrizione Le versioni di Flowise AI fino all...

CVE-2026-81562

A security flaw has been discovered in AlexGladkov claude-in-mobile 3.10.2. This affects the function execSync of the file src/adb/client.ts. Performing a manipulation results in os command injection. The attack requires a local approach. The exploit has been released to the public and may be use...

CVE-2026-81562 AlexGladkov claude-in-mobile client.ts execSync os command injection

A security flaw has been discovered in AlexGladkov claude-in-mobile 3.10.2. This affects the function execSync of the file src/adb/client.ts. Performing a manipulation results in os command injection. The attack requires a local approach. The exploit has been released to the public and may be use...

CVE-2026-81562

CVE-2026-81562 is an OS command injection vulnerability in AlexGladkov claude-in-mobile version 3.10.2 , affecting the execSync function in the file src/adb/client.ts . A local attacker with low privileges can manipulate input to inject operating system commands, leading to partial compromise of ...

EUVD-2026-67004

A security flaw has been discovered in AlexGladkov claude-in-mobile 3.10.2. This affects the function execSync of the file src/adb/client.ts. Performing a manipulation results in os command injection. The attack requires a local approach. The exploit has been released to the public and may be use...

Info-Sys-Security-CVE-2025-55182

Laboratório de Segurança CVE-2025-55182 "React2Shell" Este repositório contém um laboratório acadêmico local para analisar a CVE-2025-55182 em um ambiente controlado de React Server Components. O laboratório simula a vulnerabilidade, sua exploração e o patch aplicado. 📁 Estrutura do Repositório...

CVE-2024-39943-Poc

CVE-2024-39943-Poc CVE-2024-39943 rejetto HFS также известный как HTTP File Server версии 3 до 0.52.10 на Linux, UNIX и macOS позволяет удаленным аутентифицированным пользователям если у них есть права на загрузку выполнять команды ОС. Это происходит потому, что для выполнения df используется...

Node.js-CVE-2024-39943

Vulnérabilité d'exécution de commandes Node.js HFS CVE-2024-39943 WhiteHat School 3e promotion – Jeongmin Roh @JenmrR Résumé Dans un environnement de serveur HFS basé sur Node.js, il existe une vulnérabilité qui exécute le contenu des fichiers téléversés via childprocess.execSync. Un attaquant pe...

POC-CVE-2025-55182

CVE-2025-55182 उन्नत स्कैनर CVE-2025-55182 के लिए एक पूर्ण-विशेषताओं वाला शोषण उपकरण — Next.js में React सर्वर घटकों के माध्यम से दूरस्थ कोड निष्पादन। स्कैनर स्वचालित रूप से मल्टीपार्ट पेलोड तैयार करता है और कमजोर उदाहरणों पर मनमाना OS कमांड निष्पादन प्राप्त करने के लिए...

Suricata-Rule-for-Detecting-CVE-2025-55182

Regra de Detecção Suricata para CVE‑2025‑55182 Envenenamento de Ação no Next.js → RCE via Node.js execSync 📌 Descrição Este documento explica como a regra Suricata SID 900304 detecta tentativas de exploração da CVE‑2025‑55182 , uma vulnerabilidade crítica no Next.js que possibilita Envenenamento ...

CVE-2025-55182

CVE-2025-55182 root@kitploit: POST /formaction HTTP/1.1 Host: localhost Content-Type: multipart/form-data; boundary=----Boundary Content-Length: 297 ------Boundary Content-Disposition: form-data; name="$ACTIONREF0" ------Boundary Content-Disposition: form-data; name="$ACTION0:0"...

CVE-2026-16022

@oblique/cli 15.4.0 contains an OS command injection vulnerability in the project creation functionality. The CLI constructs shell commands through string concatenation and executes them with execSync. A user-controlled project-name argument is inserted into the shell command without proper...

EUVD-2026-53335

@oblique/cli 15.4.0 contains an OS command injection vulnerability in the project creation functionality. The CLI constructs shell commands through string concatenation and executes them with execSync. A user-controlled project-name argument is inserted into the shell command without proper...

CVE-2026-58195 Agentic-Flow: OS Command Injection in agentic-flow MCP server tools via unsanitized tool-parameter interpolation into execSync

Agentic-Flow is an AI agent orchestration platform. Prior to 2.0.14, agentic-flow MCP server tools in src/mcp/standalone-stdio.ts, src/mcp/fastmcp/servers/claude-flow-sdk.ts, src/mcp/fastmcp/servers/stdio-full.ts, src/mcp/fastmcp/servers/http-streaming-updated.ts,...

CVE-2026-58195 Agentic-Flow: OS Command Injection in agentic-flow MCP server tools via unsanitized tool-parameter interpolation into execSync

Agentic-Flow is an AI agent orchestration platform. Prior to 2.0.14, agentic-flow MCP server tools in src/mcp/standalone-stdio.ts, src/mcp/fastmcp/servers/claude-flow-sdk.ts, src/mcp/fastmcp/servers/stdio-full.ts, src/mcp/fastmcp/servers/http-streaming-updated.ts,...

MAL-2026-6338 Malicious code in log-taker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 30b4bde2f8e6fa87d896e86967b814a70ae3e46f1b1d58ed4552d1d909fbfcfe index.js imports childprocess and invokes execSync with bash and zsh shell strings around lines 315 and 331. The pattern of spawning interactive shel...

CVE-2026-55249

The CVE-2026-55249 issue affects @rtk-ai/rtk-rewrite OpenClaw plugin (v1.0.0), where attacker-controlled input is injected into a shell-backed execSync() template string. JSON.stringify() wraps values in quotes but does not neutralize shell metacharacters, leaving $() and backticks untouched. Sin...

PT-2026-51580

Name of the Vulnerable Software and Affected Versions @rtk-ai/rtk-rewrite version 1.0.0 Description The @rtk-ai/rtk-rewrite OpenClaw plugin fails to properly escape input passed to a shell-backed execSync function. While JSON.stringify is used to wrap values in double quotes, it does not neutrali...

CVE-2026-48547 KanaDojo < 0.1.18 Command Injection via patchNotesData.json in release.yml

KanaDojo contains a command injection vulnerability that allows an attacker with pull request access to execute arbitrary shell commands by inserting shell metacharacters into the version or changes fields of patchNotesData.json, which are interpolated unsanitized into a childprocess.execSync cal...

CVE-2026-25244

WebdriverIO is a test automation framework for unit, e2e and component testing using WebDriver, WebDriver BiDi and Appium. Versions below 9.24.0 contain a command injection vulnerability leading to remote code execution RCE in test orchestration. Git permits branch names containing shell...