Atlantis: OS Command Injection Through PR-controlled Terraform Workspace Enables RCE During Plan

Summary Atlantis passes the Terraform "workspace" value from a pull request's "atlantis.yaml" into a shell command without quoting or escaping it. A contributor whose pull request is eligible for an Atlantis plan can include shell metacharacters in the workspace name and execute arbitrary command...

Atlantis: OS command injection through PR-controlled Terraform workspace enables RCE during plan

Summary Atlantis passes the Terraform workspace value from a pull request's atlantis.yaml into a shell command without quoting or escaping it. A contributor whose pull request is eligible for an Atlantis plan can include shell metacharacters in the workspace name and execute arbitrary commands as...

CVE-2026-116676

Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. From version 0.4.0 until 0.47.1, Atlantis passes the pull-request-controlled workspace value from atlantis.yaml into Terraform command arguments that are joined with strings.Joinargs, " " and...

CVE-2026-116676 Atlantis: OS command injection through PR-controlled Terraform workspace enables RCE during plan

Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. From version 0.4.0 until 0.47.1, Atlantis passes the pull-request-controlled workspace value from atlantis.yaml into Terraform command arguments that are joined with strings.Joinargs, " " and...

CVE-2026-116676

Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. From version 0.4.0 until 0.47.1, Atlantis passes the pull-request-controlled workspace value from atlantis.yaml into Terraform command arguments that are joined with strings.Joinargs, " " and...

CVE-2026-116676 Atlantis: OS command injection through PR-controlled Terraform workspace enables RCE during plan

Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. From version 0.4.0 until 0.47.1, Atlantis passes the pull-request-controlled workspace value from atlantis.yaml into Terraform command arguments that are joined with strings.Joinargs, " " and...

CVE-2026-116676

The Atlantis self-hosted Go application (versions 0.4.0 through 0.47.1) is vulnerable to OS command injection . The flaw exists because the application passes the pull-request-controlled workspace value from atlantis.yaml into Terraform command arguments, which are joined using strings.Join(args,...

Brekeke PBX — Unauthenticated XmlTransBean Util.exec RCE

Unauthenticated POST to /pbx/gate?bean=web.XmlTransBean with a crafted XmlTransBean payload reaches com.brekeke.util.Util.execString and runs arbitrary commands via sh -c. !/usr/bin/env python3 -- coding: utf-8 -- """Brekeke PBX — Unauthenticated XmlTransBean Util.exec RCE""" from future import...

PT-2026-126705

Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. From version 0.4.0 until 0.47.1, Atlantis passes the pull-request-controlled workspace value from atlantis.yaml into Terraform command arguments that are joined with strings.Joinargs, " " and...

PT-2026-127754

Summary Atlantis passes the Terraform workspace value from a pull request's atlantis.yaml into a shell command without quoting or escaping it. A contributor whose pull request is eligible for an Atlantis plan can include shell metacharacters in the workspace name and execute arbitrary commands as...

CVE-2026-103038

PingTools Network Utilities 4.64 contains an OS command injection vulnerability in the Host field of a Watcher ICMP service. The application appends the attacker-controlled Host value to a ping command, serializes the command as a single string, and executes it through sh -c. A local attacker who...

EUVD-2026-104454

PingTools Network Utilities 4.64 contains an OS command injection vulnerability in the Host field of a Watcher ICMP service. The application appends the attacker-controlled Host value to a ping command, serializes the command as a single string, and executes it through sh -c. A local attacker who...

CVE-2026-103038: Improper Neutralization of Special Elements used in an OS Command

PingTools Network Utilities 4.64 contains an OS command injection vulnerability in the Host field of a Watcher ICMP service. The application appends the attacker-controlled Host value to a ping command, serializes the command as a single string, and executes it through sh -c. A local attacker who...

PT-2026-117477

Name of the Vulnerable Software and Affected Versions PingTools Network Utilities version 4.64 Description The application contains an OS command injection flaw within the Watcher ICMP service. A local attacker capable of creating or modifying a Watcher service can provide an arbitrary value in t...

CVE-2026-55601

MultiTail is a utility for monitoring multiple log files in one terminal. In version 7.1.5 and earlier, the -ex and -eX execute-on-match feature appended attacker-controlled matched input to a configured command inside double quotes, then checkfilterexec in mt.c passed the constructed command...

CVE-2026-55601 MultiTail: Shell injection in execute-on-match command handling

MultiTail is a utility for monitoring multiple log files in one terminal. In version 7.1.5 and earlier, the -ex and -eX execute-on-match feature appended attacker-controlled matched input to a configured command inside double quotes, then checkfilterexec in mt.c passed the constructed command...

CVE-2026-55601: Improper Neutralization of Special Elements used in an OS Command

MultiTail is a utility for monitoring multiple log files in one terminal. In version 7.1.5 and earlier, the -ex and -eX execute-on-match feature appended attacker-controlled matched input to a configured command inside double quotes, then checkfilterexec in mt.c passed the constructed command...

CVE-2026-101947

ExifTool for photo and video 5.0.1-gms by CellHubs constructs shell command strings from file paths and invokes /system/bin/sh -c. In the CSV-export path, the selected media path is merely surrounded with single quotes; embedded single quotes are not escaped...

CVE-2026-101947 ExifTool for photo and video 5.0.1 - Local OS command injection through filenames during CSV export

ExifTool for photo and video 5.0.1-gms by CellHubs constructs shell command strings from file paths and invokes /system/bin/sh -c. In the CSV-export path, the selected media path is merely surrounded with single quotes; embedded single quotes are not escaped...

EUVD-2026-96030

ExifTool for photo and video 5.0.1-gms by CellHubs constructs shell command strings from file paths and invokes /system/bin/sh -c. In the CSV-export path, the selected media path is merely surrounded with single quotes; embedded single quotes are not escaped...