PT-2026-106212

Name of the Vulnerable Software and Affected Versions Penpot versions prior to 2.18.0 Description The SVG exporter improperly handles the fill-color value of a text object, inserting it into a ppmcolormask command string that is then executed via child process.exec. An attacker with file editing...

PT-2026-103000

A vulnerability was identified in 0xshariq github-mcp-server up to 52e764a7d66eac1726fce02ca7bb5a638571801a. This issue affects the function child process.exec of the file src/github.ts of the component Git Remove MCP Tool. Such manipulation of the argument File leads to os command injection. The...

PT-2026-97912

Name of the Vulnerable Software and Affected Versions Dokploy versions prior to 0.29.13 Description An authenticated organization member with service:read permission can execute arbitrary commands as root within the Dokploy container. The issue occurs because the patch.readRepoDirectories tRPC...

PT-2026-95973

Name of the Vulnerable Software and Affected Versions 0-Gaurav-0 nexus-mcp affected versions not specified Description Command injection is possible in the nexus reauth MCP tool within the file src/auth/browser.ts. The issue occurs when the url argument is passed to the child process.exec functio...

Arbitrary Code Injection

Overview Affected versions of this package are vulnerable to Arbitrary Code Injection via the backendconfig property deserialization in the profile edit API endpoint. An attacker can inject arbitrary configuration values that are written verbatim into the generated Liquidsoap script, enabling...

PT-2026-69883

Name of the Vulnerable Software and Affected Versions Dokploy versions prior to 0.29.13 Description An authenticated user with backup:read permission can execute arbitrary commands on the host. This occurs because the backup.listBackupFiles tRPC endpoint in apps/dokploy/server/api/routers/backup....

PT-2026-69923

Name of the Vulnerable Software and Affected Versions Dokploy versions prior to 0.29.13 Description The backup and restore pipeline constructs shell commands by directly interpolating user-controlled database fields into bash -c and sh -c strings, which are then executed via the child process.exe...

PT-2026-8318

Name of the Vulnerable Software and Affected Versions yued-fe LuLu UI versions up to 3.0.0 Description A security flaw exists in yued-fe LuLu UI, specifically in the child process.exec function within the run.js file. This allows for operating system command injection, and the attack can be...

CVE-2021-27185

The samba-client package before 4.0.0 for Node.js allows command injection because of the use of process.exec...

PT-2025-36608

Summary A command injection vulnerability exists in the mcp-markdownify-server MCP Server. The vulnerability is caused by the unsanitized use of input parameters within a call to child process.exec, enabling an attacker to inject arbitrary system commands. Successful exploitation can lead to remo...

Command Injection

Overview Affected versions of the samba-client package allow command injection because of the use of process.exec. Recommendation Upgrade to version 4.0.0 or later References - CVE - GitHub Advisory...

OS Command Injection

samba-client is vulnerable to OS command injection. The use of process.exec allows an attacker to inject and execute arbitrary OS commands on the host OS...

GHSA-R3J7-X2G5-9GX6 Command injection in samba-client

The samba-client package before 4.0.0 for Node.js allows command injection because of the use of process.exec...

Command injection in samba-client

The samba-client package before 4.0.0 for Node.js allows command injection because of the use of process.exec...

CVE-2021-27185

The samba-client package before 4.0.0 for Node.js allows command injection because of the use of process.exec...

CVE-2021-27185

The samba-client package before 4.0.0 for Node.js allows command injection because of the use of process.exec...

CVE-2021-27185

The samba-client package before 4.0.0 for Node.js allows command injection because of the use of process.exec...

CVE-2021-27185

The samba-client package before 4.0.0 for Node.js allows command injection because of the use of process.exec...

CVE-2021-27185: Improper Neutralization of Special Elements used in a Command

The samba-client package before 4.0.0 for Node.js allows command injection because of the use of process.exec...

PT-2021-17304

Name of the Vulnerable Software and Affected Versions: samba-client versions prior to 4.0.0 Description: The issue allows command injection due to the use of process.exec. This is a problem in the samba-client package for Node.js. Recommendations: For versions prior to 4.0.0, update to version...