Common Weakness Enumeration
CWE-94
Allowed-with-ReviewImproper Control of Generation of Code ('Code Injection')
Abstraction: Base · Status: Draft
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
8825 vulnerabilities reference this CWE, most recent first.
CVE-2026-81662 (GCVE-0-2026-81662)
Vulnerability from cvelistv5 – Published: 2026-08-27 10:23 – Updated: 2026-08-27 15:53
VLAI
EPSS
VEX
Title
Flowintel Alert Settings Configuration Allows Remote Code Execution via Arbitrary Configuration Keys
Summary
Affected versions of Flowintel improperly trust configuration keys supplied to the alerts settings update endpoint. While configuration values were normalized to Python literals, the corresponding keys were used directly when constructing and replacing lines in conf/config_module.py.
The vulnerable code used requester-controlled keys in both the regular expression and the generated assignment:
f'{key} = {py_val}'
and appended an assignment if the key was not already present. The modified Python configuration module was subsequently reloaded using importlib.reload(). This creates a code-generation boundary in which specially crafted configuration keys can alter the Python source structure and result in execution of attacker-controlled Python statements.
Version impacted >=3.3.0
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-27 15:53 UTC
CWE
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/flowintel/flowintel/commit/d36… | patch |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-81662",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-27T15:53:09.787426Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T15:53:21.261Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "flowintel",
"repo": "https://github.com/flowintel/flowintel",
"vendor": "flowintel",
"versions": [
{
"lessThanOrEqual": "3.3.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jeroen Pinoy"
},
{
"lang": "en",
"type": "remediation developer",
"value": "David Cruciani"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAffected versions of Flowintel improperly trust configuration keys supplied to the alerts settings update endpoint. While configuration values were normalized to Python literals, the corresponding keys were used directly when constructing and replacing lines in \u003ccode\u003econf/config_module.py\u003c/code\u003e.\u003c/p\u003e\n\u003cp\u003eThe vulnerable code used requester-controlled keys in both the regular expression and the generated assignment:\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003ef\u0027{key} = {py_val}\u0027\u003c/code\u003e\u003c/p\u003e\u003cp\u003eand appended an assignment if the key was not already present. The modified Python configuration module was subsequently reloaded using \u003ccode\u003eimportlib.reload()\u003c/code\u003e. This creates a code-generation boundary in which specially crafted configuration keys can alter the Python source structure and result in execution of attacker-controlled Python statements. \u003c/p\u003eVersion impacted \u0026gt;=3.3.0"
}
],
"value": "Affected versions of Flowintel improperly trust configuration keys supplied to the alerts settings update endpoint. While configuration values were normalized to Python literals, the corresponding keys were used directly when constructing and replacing lines in conf/config_module.py.\n\n\nThe vulnerable code used requester-controlled keys in both the regular expression and the generated assignment:\n\n\nf\u0027{key} = {py_val}\u0027\n\nand appended an assignment if the key was not already present. The modified Python configuration module was subsequently reloaded using importlib.reload(). This creates a code-generation boundary in which specially crafted configuration keys can alter the Python source structure and result in execution of attacker-controlled Python statements. \n\nVersion impacted \u003e=3.3.0"
}
],
"impacts": [
{
"capecId": "CAPEC-242",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-242 Code Injection"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20 Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T11:30:05.008Z",
"orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"shortName": "CIRCL"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/flowintel/flowintel/commit/d36171e22aed99055539260bec75e6355ada7d0c"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Flowintel Alert Settings Configuration Allows Remote Code Execution via Arbitrary Configuration Keys",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"assignerShortName": "CIRCL",
"cveId": "CVE-2026-81662",
"datePublished": "2026-08-27T10:23:01.833Z",
"dateReserved": "2026-08-27T10:22:59.027Z",
"dateUpdated": "2026-08-27T15:53:21.261Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-81096 (GCVE-0-2026-81096)
Vulnerability from cvelistv5 – Published: 2026-08-27 14:50 – Updated: 2026-08-29 11:48
VLAI
EPSS
VEX
Title
ToolUniverse through 1.2.6 Unauthenticated Remote Code Execution via python_code_executor Sandbox Escape
Summary
ToolUniverse ran caller-supplied Python inside a sandbox that could be escaped, on a server that required no authentication. The executor behind the python_code_executor tool, in python_executor_tool.py, inspected the submitted source for a denied list of attribute names and calls but left the attribute-lookup builtins available and did not stop a dunder attribute reached through a string lookup or through a module already permitted, so a caller could walk from a literal's class to its base and enumerate subclasses to obtain a reference to the process and subprocess modules. A per-call argument also let the caller widen the import allow-list before the inspection ran. The HTTP and MCP servers in http_api_server.py and smcp_server.py bound to every interface with debugging enabled and no authentication, so any caller able to reach the port executed code as the server process. Version 1.3.0 adds bearer-token authentication, defaults the bind address to loopback, and hardens the attribute checks.
Severity
10 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-27 18:13 UTC
CWE
- CWE-94 - Improper Control of Generation of Code ('Code Injection')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/mims-harvard/ToolUniverse | product |
| https://github.com/mims-harvard/ToolUniverse/pull/251 | issue-trackingpatch |
| https://github.com/mims-harvard/ToolUniverse/secu… | vendor-advisory |
| https://www.vulncheck.com/advisories/tooluniverse… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| mims-harvard | ToolUniverse |
Affected:
0 , ≤ 1.2.6
(semver)
|
Date Public
2026-08-26 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-81096",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-27T18:13:07.150435Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T18:13:19.374Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://github.com/mims-harvard/ToolUniverse",
"defaultStatus": "unaffected",
"packageURL": "pkg:pypi/tooluniverse",
"product": "ToolUniverse",
"repo": "https://github.com/mims-harvard/ToolUniverse",
"vendor": "mims-harvard",
"versions": [
{
"lessThanOrEqual": "1.2.6",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Avishai Gonen (Pluto Security)"
}
],
"datePublic": "2026-08-26T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "ToolUniverse ran caller-supplied Python inside a sandbox that could be escaped, on a server that required no authentication. The executor behind the python_code_executor tool, in python_executor_tool.py, inspected the submitted source for a denied list of attribute names and calls but left the attribute-lookup builtins available and did not stop a dunder attribute reached through a string lookup or through a module already permitted, so a caller could walk from a literal\u0027s class to its base and enumerate subclasses to obtain a reference to the process and subprocess modules. A per-call argument also let the caller widen the import allow-list before the inspection ran. The HTTP and MCP servers in http_api_server.py and smcp_server.py bound to every interface with debugging enabled and no authentication, so any caller able to reach the port executed code as the server process. Version 1.3.0 adds bearer-token authentication, defaults the bind address to loopback, and hardens the attribute checks."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-29T11:48:10.764Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"product"
],
"url": "https://github.com/mims-harvard/ToolUniverse"
},
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/mims-harvard/ToolUniverse/pull/251"
},
{
"name": "GitHub Security Advisory (GHSA-pxwq-22vf-87fm)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/mims-harvard/ToolUniverse/security/advisories/GHSA-pxwq-22vf-87fm"
},
{
"name": "VulnCheck Advisory: ToolUniverse through 1.2.6 Unauthenticated Remote Code Execution via python_code_executor Sandbox Escape",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/tooluniverse-through-1.2.6-unauthenticated-remote-code-execution-via-python-code-executor-sandbox-escape"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "ToolUniverse through 1.2.6 Unauthenticated Remote Code Execution via python_code_executor Sandbox Escape",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-81096",
"datePublished": "2026-08-27T14:50:36.897Z",
"dateReserved": "2026-08-26T16:00:32.344Z",
"dateUpdated": "2026-08-29T11:48:10.764Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80201 (GCVE-0-2026-80201)
Vulnerability from cvelistv5 – Published: 2026-08-25 23:19 – Updated: 2026-08-26 14:16
VLAI
EPSS
VEX
Title
Kimai before 2.53.0 API Token Leakage via Invoice Template
Summary
Kimai before 2.53.0 fails to block sensitive User methods in the Twig invoice template sandbox, allowing admins to call getApiToken() and getPlainApiToken() methods. Attackers with template creation permissions can embed these method calls in invoice templates to leak hashed API tokens in rendered invoice output.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-26 14:16 UTC
CWE
- CWE-94 - Improper Control of Generation of Code ('Code Injection')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/kimai/kimai/security/advisorie… | vendor-advisory |
| https://www.vulncheck.com/advisories/kimai-before… | third-party-advisory |
Impacted products
Date Public
2026-04-11 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-80201",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-26T14:16:14.479982Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T14:16:34.776Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/kimai/kimai/security/advisories/GHSA-rh42-6rj2-xwmc"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "kimai",
"vendor": "kimai",
"versions": [
{
"lessThan": "2.53.0",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.53.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:kimai:kimai:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.53.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "hett-patell"
}
],
"datePublic": "2026-04-11T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Kimai before 2.53.0 fails to block sensitive User methods in the Twig invoice template sandbox, allowing admins to call getApiToken() and getPlainApiToken() methods. Attackers with template creation permissions can embed these method calls in invoice templates to leak hashed API tokens in rendered invoice output."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2,
"baseSeverity": "LOW",
"privilegesRequired": "HIGH",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 2,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T23:19:06.486Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-rh42-6rj2-xwmc)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/kimai/kimai/security/advisories/GHSA-rh42-6rj2-xwmc"
},
{
"name": "VulnCheck Advisory: Kimai before 2.53.0 API Token Leakage via Invoice Template",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/kimai-before-2.53.0-api-token-leakage-via-invoice-template"
}
],
"title": "Kimai before 2.53.0 API Token Leakage via Invoice Template",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-80201",
"datePublished": "2026-08-25T23:19:06.486Z",
"dateReserved": "2026-08-25T23:14:37.730Z",
"dateUpdated": "2026-08-26T14:16:34.776Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-79793 (GCVE-0-2026-79793)
Vulnerability from cvelistv5 – Published: 2026-08-25 21:00 – Updated: 2026-08-26 12:37 X_Freeware
VLAI
EPSS
VEX
Title
code-projects Online Shopping System sumit_form.php cross site scripting
Summary
A vulnerability has been found in code-projects Online Shopping System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/sumit_form.php. Such manipulation of the argument Success leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-26 12:37 UTC
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/395055 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/395055/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-79793 | third-party-advisory |
| https://vuldb.com/submit/871817 | third-party-advisory |
| https://github.com/zzzxc643/CVE1/blob/main/online… | exploit |
| https://code-projects.org/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| code-projects | Online Shopping System |
Affected:
1.0
cpe:2.3:a:code-projects:online_shopping_system:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-79793",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-26T12:37:19.999730Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T12:37:35.552Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:code-projects:online_shopping_system:*:*:*:*:*:*:*:*"
],
"product": "Online Shopping System",
"vendor": "code-projects",
"versions": [
{
"status": "affected",
"version": "1.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "SSL_Seven_Security Lab_WangZhiQiang_XiaoZiLong (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been found in code-projects Online Shopping System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/sumit_form.php. Such manipulation of the argument Success leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Cross Site Scripting",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "Code Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T21:00:11.819Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-395055 | code-projects Online Shopping System sumit_form.php cross site scripting",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/395055"
},
{
"name": "VDB-395055 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/395055/cti"
},
{
"name": "CVE-2026-79793 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-79793"
},
{
"name": "Submit #871817 | ONLINE SHOPPING SYSTEM admin/sumit_form.php Reflected XSS Vulnerability v1 Reflected XSS",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/871817"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/zzzxc643/CVE1/blob/main/online-shopping-system/vul7.md"
},
{
"tags": [
"product"
],
"url": "https://code-projects.org/"
}
],
"tags": [
"x_freeware"
],
"timeline": [
{
"lang": "en",
"time": "2026-08-25T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-25T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-08-25T16:45:49.000Z",
"value": "VulDB entry last update"
}
],
"title": "code-projects Online Shopping System sumit_form.php cross site scripting",
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-79793",
"datePublished": "2026-08-25T21:00:11.819Z",
"dateReserved": "2026-08-25T14:40:43.987Z",
"dateUpdated": "2026-08-26T12:37:35.552Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-78654 (GCVE-0-2026-78654)
Vulnerability from cvelistv5 – Published: 2026-08-25 06:00 – Updated: 2026-08-25 13:17 X_Open Source
VLAI
EPSS
VEX
Title
cleverbrush framework/deep deepExtend.ts deepExtend prototype pollution
Summary
A vulnerability has been found in cleverbrush framework and deep up to 4.4.0. This impacts the function deepExtend of the file libs/deep/src/deepExtend.ts. The manipulation leads to improperly controlled modification of object prototype attributes. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. Upgrading to version 4.4.1 will fix this issue. The identifier of the patch is 810398c1308c500c3b8b6af380b5a89371389327. You should upgrade the affected component.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-25 13:17 UTC
CWE
Assigner
References
9 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/394866 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/394866/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-78654 | third-party-advisory |
| https://vuldb.com/submit/886401 | third-party-advisory |
| https://github.com/cleverbrush/framework/issues/213 | exploitissue-tracking |
| https://github.com/cleverbrush/framework/pull/215 | issue-trackingpatch |
| https://github.com/cleverbrush/framework/commit/8… | patch |
| https://github.com/cleverbrush/framework/releases… | patch |
| https://github.com/cleverbrush/framework/ | product |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| cleverbrush | framework |
Affected:
4.0
Affected: 4.1 Affected: 4.2 Affected: 4.3 Affected: 4.4.0 Unaffected: 4.4.1 cpe:2.3:a:cleverbrush:framework:*:*:*:*:*:*:*:* |
|
| cleverbrush | deep |
Affected:
4.0
Affected: 4.1 Affected: 4.2 Affected: 4.3 Affected: 4.4.0 Unaffected: 4.4.1 cpe:2.3:a:cleverbrush:deep:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-78654",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-25T13:17:25.816993Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T13:17:33.100Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://vuldb.com/submit/886401"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:cleverbrush:framework:*:*:*:*:*:*:*:*"
],
"product": "framework",
"vendor": "cleverbrush",
"versions": [
{
"status": "affected",
"version": "4.0"
},
{
"status": "affected",
"version": "4.1"
},
{
"status": "affected",
"version": "4.2"
},
{
"status": "affected",
"version": "4.3"
},
{
"status": "affected",
"version": "4.4.0"
},
{
"status": "unaffected",
"version": "4.4.1"
}
]
},
{
"cpes": [
"cpe:2.3:a:cleverbrush:deep:*:*:*:*:*:*:*:*"
],
"product": "deep",
"vendor": "cleverbrush",
"versions": [
{
"status": "affected",
"version": "4.0"
},
{
"status": "affected",
"version": "4.1"
},
{
"status": "affected",
"version": "4.2"
},
{
"status": "affected",
"version": "4.3"
},
{
"status": "affected",
"version": "4.4.0"
},
{
"status": "unaffected",
"version": "4.4.1"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Classif1ed_mick (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been found in cleverbrush framework and deep up to 4.4.0. This impacts the function deepExtend of the file libs/deep/src/deepExtend.ts. The manipulation leads to improperly controlled modification of object prototype attributes. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. Upgrading to version 4.4.1 will fix this issue. The identifier of the patch is 810398c1308c500c3b8b6af380b5a89371389327. You should upgrade the affected component."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1321",
"description": "Improperly Controlled Modification of Object Prototype Attributes",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "Code Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T06:00:13.406Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-394866 | cleverbrush framework/deep deepExtend.ts deepExtend prototype pollution",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/394866"
},
{
"name": "VDB-394866 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/394866/cti"
},
{
"name": "CVE-2026-78654 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-78654"
},
{
"name": "Submit #886401 | cleverbrush @cleverbrush/deep (npm) \u003c=4.4.0 Prototype Pollution",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/886401"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/cleverbrush/framework/issues/213"
},
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/cleverbrush/framework/pull/215"
},
{
"tags": [
"patch"
],
"url": "https://github.com/cleverbrush/framework/commit/810398c1308c500c3b8b6af380b5a89371389327"
},
{
"tags": [
"patch"
],
"url": "https://github.com/cleverbrush/framework/releases/tag/%40cleverbrush/async%404.4.1"
},
{
"tags": [
"product"
],
"url": "https://github.com/cleverbrush/framework/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-08-24T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-08-25T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-25T01:13:27.000Z",
"value": "VulDB entry last update"
}
],
"title": "cleverbrush framework/deep deepExtend.ts deepExtend prototype pollution",
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-78654",
"datePublished": "2026-08-25T06:00:13.406Z",
"dateReserved": "2026-08-24T23:08:18.011Z",
"dateUpdated": "2026-08-25T13:17:33.100Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-78367 (GCVE-0-2026-78367)
Vulnerability from cvelistv5 – Published: 2026-08-24 13:48 – Updated: 2026-08-24 16:24
VLAI
EPSS
VEX
Title
Rpm: rpmbuild gettarspec() crafted tar member name → macro injection
Summary
A vulnerability was found in RPM's rpmbuild tarball processing. When processing a crafted source archive, the getTarSpec() function in tools/rpmbuild.cc passes an attacker-controlled tar archive member name to rpmExpand() as part of a %{basename:...} macro expression. A specially crafted .spec member name can therefore inject RPM macros, including Lua expressions, resulting in arbitrary code execution with the privileges of the user running rpmbuild. This can be exploited when a victim or automated build system processes an attacker-controlled source tarball using rpmbuild tarball mode (such as -ts, -ta, or -tb).
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-24 15:13 UTC
CWE
- CWE-94 - Improper Control of Generation of Code ('Code Injection')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://access.redhat.com/security/cve/CVE-2026-78367 | vdb-entryx_refsource_REDHAT |
| https://bugzilla.redhat.com/show_bug.cgi?id=2521857 | issue-trackingx_refsource_REDHAT |
| https://github.com/rpm-software-management/rpm/is… |
Impacted products
7 products
| Vendor | Product | Version | |
|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 |
cpe:/o:redhat:enterprise_linux:10
|
|
| Red Hat | Red Hat Enterprise Linux 6 |
cpe:/o:redhat:enterprise_linux:6
|
|
| Red Hat | Red Hat Enterprise Linux 7 |
cpe:/o:redhat:enterprise_linux:7
|
|
| Red Hat | Red Hat Enterprise Linux 8 |
cpe:/o:redhat:enterprise_linux:8
|
|
| Red Hat | Red Hat Enterprise Linux 9 |
cpe:/o:redhat:enterprise_linux:9
|
|
| Red Hat | Red Hat Hardened Images |
cpe:/a:redhat:hummingbird:1
|
|
| Red Hat | Red Hat OpenShift Container Platform 4 |
cpe:/a:redhat:openshift:4
|
Date Public
2026-08-24 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-78367",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-24T15:13:40.183552Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-24T15:14:08.592Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/rpm-software-management/rpm/issues/4314"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10"
],
"defaultStatus": "affected",
"packageName": "rpm",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:6"
],
"defaultStatus": "unknown",
"packageName": "rpm",
"product": "Red Hat Enterprise Linux 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "affected",
"packageName": "rpm",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "affected",
"packageName": "rpm",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "rpm",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:hummingbird:1"
],
"defaultStatus": "affected",
"packageName": "rpm",
"product": "Red Hat Hardened Images",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4"
],
"defaultStatus": "unknown",
"packageName": "openshift/ose-rhel-coreos-8",
"product": "Red Hat OpenShift Container Platform 4",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4"
],
"defaultStatus": "unknown",
"packageName": "openshift/ose-rhel-coreos-9",
"product": "Red Hat OpenShift Container Platform 4",
"vendor": "Red Hat"
}
],
"credits": [
{
"lang": "en",
"value": "This issue was discovered by Sandipan Roy (Red Hat)."
}
],
"datePublic": "2026-08-24T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in RPM\u0027s rpmbuild tarball processing. When processing a crafted source archive, the getTarSpec() function in tools/rpmbuild.cc passes an attacker-controlled tar archive member name to rpmExpand() as part of a %{basename:...} macro expression. A specially crafted .spec member name can therefore inject RPM macros, including Lua expressions, resulting in arbitrary code execution with the privileges of the user running rpmbuild. This can be exploited when a victim or automated build system processes an attacker-controlled source tarball using rpmbuild tarball mode (such as -ts, -ta, or -tb)."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Moderate"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-24T16:24:55.536Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-78367"
},
{
"name": "RHBZ#2521857",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2521857"
},
{
"url": "https://github.com/rpm-software-management/rpm/issues/4314"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-24T00:00:00.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-08-24T00:00:00.000Z",
"value": "Made public."
}
],
"title": "Rpm: rpmbuild gettarspec() crafted tar member name \u2192 macro injection",
"workarounds": [
{
"lang": "en",
"value": "Do not process untrusted tarballs with rpmbuild -ta/-tb/-ts. Extract and inspect archives first (reject member names containing }, %, or {), or build from a reviewed .spec outside tarball mode. Prefer isolated builders (mock/container) for any untrusted packaging related work."
}
],
"x_generator": {
"engine": "cvelib 1.8.0"
},
"x_redhatCweChain": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)"
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2026-78367",
"datePublished": "2026-08-24T13:48:52.103Z",
"dateReserved": "2026-08-24T12:52:02.839Z",
"dateUpdated": "2026-08-24T16:24:55.536Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-78187 (GCVE-0-2026-78187)
Vulnerability from cvelistv5 – Published: 2026-08-24 04:30 – Updated: 2026-08-24 16:36 X_Open Source
VLAI
EPSS
VEX
Title
Piwigo Public Authentication cross site scripting
Summary
A vulnerability has been found in Piwigo 16.3.0. This impacts an unknown function of the component Public Authentication Page. Such manipulation of the argument lang leads to cross site scripting. The attack may be performed from remote. A high complexity level is associated with this attack. The exploitability is said to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 16.4.0 will fix this issue. The name of the patch is 5277a7dee4b8f1a174f1d69e1e2a4e1c82a3fc9e. It is recommended to upgrade the affected component.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-24 16:36 UTC
Assigner
References
9 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/394569 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/394569/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-78187 | third-party-advisory |
| https://vuldb.com/submit/885228 | third-party-advisory |
| https://github.com/Piwigo/Piwigo/security/advisor… | related |
| https://github.com/Leousum/VulnPoC/blob/main/Piwi… | exploit |
| https://github.com/Piwigo/Piwigo/commit/5277a7dee… | patch |
| https://github.com/Piwigo/Piwigo/releases/tag/16.4.0 | patch |
| https://github.com/Piwigo/Piwigo/ | product |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-78187",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-24T16:36:07.115960Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-24T16:36:20.799Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:piwigo:piwigo:*:*:*:*:*:*:*:*"
],
"modules": [
"Public Authentication Page"
],
"product": "Piwigo",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "16.3.0"
},
{
"status": "unaffected",
"version": "16.4.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Leousum (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been found in Piwigo 16.3.0. This impacts an unknown function of the component Public Authentication Page. Such manipulation of the argument lang leads to cross site scripting. The attack may be performed from remote. A high complexity level is associated with this attack. The exploitability is said to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 16.4.0 will fix this issue. The name of the patch is 5277a7dee4b8f1a174f1d69e1e2a4e1c82a3fc9e. It is recommended to upgrade the affected component."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 2.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 3.1,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 3.1,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 2.6,
"vectorString": "AV:N/AC:H/Au:N/C:N/I:P/A:N/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Cross Site Scripting",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "Code Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-24T04:30:08.597Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-394569 | Piwigo Public Authentication cross site scripting",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/394569"
},
{
"name": "VDB-394569 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/394569/cti"
},
{
"name": "CVE-2026-78187 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-78187"
},
{
"name": "Submit #885228 | Piwigo 16.3.0 Cross Site Scripting",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/885228"
},
{
"tags": [
"related"
],
"url": "https://github.com/Piwigo/Piwigo/security/advisories/GHSA-rr39-mf4j-6594"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/Leousum/VulnPoC/blob/main/Piwigo%2016.3.0/reflected_XSS.md"
},
{
"tags": [
"patch"
],
"url": "https://github.com/Piwigo/Piwigo/commit/5277a7dee4b8f1a174f1d69e1e2a4e1c82a3fc9e"
},
{
"tags": [
"patch"
],
"url": "https://github.com/Piwigo/Piwigo/releases/tag/16.4.0"
},
{
"tags": [
"product"
],
"url": "https://github.com/Piwigo/Piwigo/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-08-23T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-23T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-08-23T19:02:44.000Z",
"value": "VulDB entry last update"
}
],
"title": "Piwigo Public Authentication cross site scripting",
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-78187",
"datePublished": "2026-08-24T04:30:08.597Z",
"dateReserved": "2026-08-23T16:57:37.940Z",
"dateUpdated": "2026-08-24T16:36:20.799Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-78181 (GCVE-0-2026-78181)
Vulnerability from cvelistv5 – Published: 2026-08-24 03:30 – Updated: 2026-08-26 18:12
VLAI
EPSS
VEX
Title
ractivejs ractive Keypath Ractive#set prototype pollution
Summary
A weakness has been identified in ractivejs ractive up to 1.4.4. Impacted is the function Ractive#set of the component Keypath Handler. Executing a manipulation can lead to improperly controlled modification of object prototype attributes. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-26 18:12 UTC
CWE
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/394565 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/394565/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-78181 | third-party-advisory |
| https://vuldb.com/submit/884187 | third-party-advisory |
| https://github.com/ractivejs/ractive/issues/3448 | exploitissue-tracking |
| https://github.com/ractivejs/ractive/ | product |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-78181",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-26T18:12:03.169241Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T18:12:12.239Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:ractivejs:ractive:*:*:*:*:*:*:*:*"
],
"modules": [
"Keypath Handler"
],
"product": "ractive",
"vendor": "ractivejs",
"versions": [
{
"status": "affected",
"version": "1.4.0"
},
{
"status": "affected",
"version": "1.4.1"
},
{
"status": "affected",
"version": "1.4.2"
},
{
"status": "affected",
"version": "1.4.3"
},
{
"status": "affected",
"version": "1.4.4"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "wjm3 (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A weakness has been identified in ractivejs ractive up to 1.4.4. Impacted is the function Ractive#set of the component Keypath Handler. Executing a manipulation can lead to improperly controlled modification of object prototype attributes. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1321",
"description": "Improperly Controlled Modification of Object Prototype Attributes",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "Code Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-24T03:30:08.948Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-394565 | ractivejs ractive Keypath Ractive#set prototype pollution",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/394565"
},
{
"name": "VDB-394565 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/394565/cti"
},
{
"name": "CVE-2026-78181 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-78181"
},
{
"name": "Submit #884187 | Ractive.js ractive 1.4.4 Prototype Pollution",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/884187"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/ractivejs/ractive/issues/3448"
},
{
"tags": [
"product"
],
"url": "https://github.com/ractivejs/ractive/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-23T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-23T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-08-23T18:12:12.000Z",
"value": "VulDB entry last update"
}
],
"title": "ractivejs ractive Keypath Ractive#set prototype pollution",
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-78181",
"datePublished": "2026-08-24T03:30:08.948Z",
"dateReserved": "2026-08-23T16:06:44.078Z",
"dateUpdated": "2026-08-26T18:12:12.239Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-78180 (GCVE-0-2026-78180)
Vulnerability from cvelistv5 – Published: 2026-08-24 03:15 – Updated: 2026-08-24 17:12
VLAI
EPSS
VEX
Title
alibaba-fusion next deepMerge index.tsx ConfigProvider.getContextProps prototype pollution
Summary
A security flaw has been discovered in alibaba-fusion next up to 1.27.34. This issue affects the function ConfigProvider.getContextProps of the file components/dialog/index.tsx of the component deepMerge. Performing a manipulation of the argument locale results in improperly controlled modification of object prototype attributes. The attack may be initiated remotely. The reported GitHub issue was closed automatically due to inactivity.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-24 17:06 UTC
CWE
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/394564 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/394564/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-78180 | third-party-advisory |
| https://vuldb.com/submit/884184 | third-party-advisory |
| https://github.com/alibaba-fusion/next/issues/5101 | issue-tracking |
| https://github.com/alibaba-fusion/next/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| alibaba-fusion | next |
Affected:
1.27.0
Affected: 1.27.1 Affected: 1.27.2 Affected: 1.27.3 Affected: 1.27.4 Affected: 1.27.5 Affected: 1.27.6 Affected: 1.27.7 Affected: 1.27.8 Affected: 1.27.9 Affected: 1.27.10 Affected: 1.27.11 Affected: 1.27.12 Affected: 1.27.13 Affected: 1.27.14 Affected: 1.27.15 Affected: 1.27.16 Affected: 1.27.17 Affected: 1.27.18 Affected: 1.27.19 Affected: 1.27.20 Affected: 1.27.21 Affected: 1.27.22 Affected: 1.27.23 Affected: 1.27.24 Affected: 1.27.25 Affected: 1.27.26 Affected: 1.27.27 Affected: 1.27.28 Affected: 1.27.29 Affected: 1.27.30 Affected: 1.27.31 Affected: 1.27.32 Affected: 1.27.33 Affected: 1.27.34 cpe:2.3:a:next:next:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-78180",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-24T17:06:22.477505Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-24T17:12:36.614Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/alibaba-fusion/next/issues/5101"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:next:next:*:*:*:*:*:*:*:*"
],
"modules": [
"deepMerge"
],
"product": "next",
"vendor": "alibaba-fusion",
"versions": [
{
"status": "affected",
"version": "1.27.0"
},
{
"status": "affected",
"version": "1.27.1"
},
{
"status": "affected",
"version": "1.27.2"
},
{
"status": "affected",
"version": "1.27.3"
},
{
"status": "affected",
"version": "1.27.4"
},
{
"status": "affected",
"version": "1.27.5"
},
{
"status": "affected",
"version": "1.27.6"
},
{
"status": "affected",
"version": "1.27.7"
},
{
"status": "affected",
"version": "1.27.8"
},
{
"status": "affected",
"version": "1.27.9"
},
{
"status": "affected",
"version": "1.27.10"
},
{
"status": "affected",
"version": "1.27.11"
},
{
"status": "affected",
"version": "1.27.12"
},
{
"status": "affected",
"version": "1.27.13"
},
{
"status": "affected",
"version": "1.27.14"
},
{
"status": "affected",
"version": "1.27.15"
},
{
"status": "affected",
"version": "1.27.16"
},
{
"status": "affected",
"version": "1.27.17"
},
{
"status": "affected",
"version": "1.27.18"
},
{
"status": "affected",
"version": "1.27.19"
},
{
"status": "affected",
"version": "1.27.20"
},
{
"status": "affected",
"version": "1.27.21"
},
{
"status": "affected",
"version": "1.27.22"
},
{
"status": "affected",
"version": "1.27.23"
},
{
"status": "affected",
"version": "1.27.24"
},
{
"status": "affected",
"version": "1.27.25"
},
{
"status": "affected",
"version": "1.27.26"
},
{
"status": "affected",
"version": "1.27.27"
},
{
"status": "affected",
"version": "1.27.28"
},
{
"status": "affected",
"version": "1.27.29"
},
{
"status": "affected",
"version": "1.27.30"
},
{
"status": "affected",
"version": "1.27.31"
},
{
"status": "affected",
"version": "1.27.32"
},
{
"status": "affected",
"version": "1.27.33"
},
{
"status": "affected",
"version": "1.27.34"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "wjm3 (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security flaw has been discovered in alibaba-fusion next up to 1.27.34. This issue affects the function ConfigProvider.getContextProps of the file components/dialog/index.tsx of the component deepMerge. Performing a manipulation of the argument locale results in improperly controlled modification of object prototype attributes. The attack may be initiated remotely. The reported GitHub issue was closed automatically due to inactivity."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:ND/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1321",
"description": "Improperly Controlled Modification of Object Prototype Attributes",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "Code Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-24T03:15:08.568Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-394564 | alibaba-fusion next deepMerge index.tsx ConfigProvider.getContextProps prototype pollution",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/394564"
},
{
"name": "VDB-394564 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/394564/cti"
},
{
"name": "CVE-2026-78180 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-78180"
},
{
"name": "Submit #884184 | Node.js @alifd/next 1.27.34 Prototype Pollution",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/884184"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/alibaba-fusion/next/issues/5101"
},
{
"tags": [
"product"
],
"url": "https://github.com/alibaba-fusion/next/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-23T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-23T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-08-23T18:09:55.000Z",
"value": "VulDB entry last update"
}
],
"title": "alibaba-fusion next deepMerge index.tsx ConfigProvider.getContextProps prototype pollution",
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-78180",
"datePublished": "2026-08-24T03:15:08.568Z",
"dateReserved": "2026-08-23T16:03:29.986Z",
"dateUpdated": "2026-08-24T17:12:36.614Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-78179 (GCVE-0-2026-78179)
Vulnerability from cvelistv5 – Published: 2026-08-24 03:00 – Updated: 2026-08-24 14:07
VLAI
EPSS
VEX
Title
rexrainbow phaser3-rex-notes BehaviorTree Blackboard Data SetValue.js SetValue prototype pollution
Summary
A vulnerability was identified in rexrainbow phaser3-rex-notes up to 1.80.17. This vulnerability affects the function SetValue of the file plugins/utils/object/SetValue.js of the component BehaviorTree Blackboard Data Interface. Such manipulation of the argument key leads to improperly controlled modification of object prototype attributes. The attack can be launched remotely.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-24 14:07 UTC
CWE
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/394563 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/394563/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-78179 | third-party-advisory |
| https://vuldb.com/submit/884183 | third-party-advisory |
| https://github.com/rexrainbow/phaser3-rex-notes/i… | issue-tracking |
| https://github.com/rexrainbow/phaser3-rex-notes/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| rexrainbow | phaser3-rex-notes |
Affected:
1.80.0
Affected: 1.80.1 Affected: 1.80.2 Affected: 1.80.3 Affected: 1.80.4 Affected: 1.80.5 Affected: 1.80.6 Affected: 1.80.7 Affected: 1.80.8 Affected: 1.80.9 Affected: 1.80.10 Affected: 1.80.11 Affected: 1.80.12 Affected: 1.80.13 Affected: 1.80.14 Affected: 1.80.15 Affected: 1.80.16 Affected: 1.80.17 cpe:2.3:a:rexrainbow:phaser3-rex-notes:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-78179",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-24T14:07:07.181168Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-24T14:07:14.933Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:rexrainbow:phaser3-rex-notes:*:*:*:*:*:*:*:*"
],
"modules": [
"BehaviorTree Blackboard Data Interface"
],
"product": "phaser3-rex-notes",
"vendor": "rexrainbow",
"versions": [
{
"status": "affected",
"version": "1.80.0"
},
{
"status": "affected",
"version": "1.80.1"
},
{
"status": "affected",
"version": "1.80.2"
},
{
"status": "affected",
"version": "1.80.3"
},
{
"status": "affected",
"version": "1.80.4"
},
{
"status": "affected",
"version": "1.80.5"
},
{
"status": "affected",
"version": "1.80.6"
},
{
"status": "affected",
"version": "1.80.7"
},
{
"status": "affected",
"version": "1.80.8"
},
{
"status": "affected",
"version": "1.80.9"
},
{
"status": "affected",
"version": "1.80.10"
},
{
"status": "affected",
"version": "1.80.11"
},
{
"status": "affected",
"version": "1.80.12"
},
{
"status": "affected",
"version": "1.80.13"
},
{
"status": "affected",
"version": "1.80.14"
},
{
"status": "affected",
"version": "1.80.15"
},
{
"status": "affected",
"version": "1.80.16"
},
{
"status": "affected",
"version": "1.80.17"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "wjm3 (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was identified in rexrainbow phaser3-rex-notes up to 1.80.17. This vulnerability affects the function SetValue of the file plugins/utils/object/SetValue.js of the component BehaviorTree Blackboard Data Interface. Such manipulation of the argument key leads to improperly controlled modification of object prototype attributes. The attack can be launched remotely."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:ND/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1321",
"description": "Improperly Controlled Modification of Object Prototype Attributes",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "Code Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-24T03:00:08.841Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-394563 | rexrainbow phaser3-rex-notes BehaviorTree Blackboard Data SetValue.js SetValue prototype pollution",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/394563"
},
{
"name": "VDB-394563 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/394563/cti"
},
{
"name": "CVE-2026-78179 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-78179"
},
{
"name": "Submit #884183 | Node.js phaser3-rex-plugins 1.80.17 Prototype Pollution",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/884183"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/rexrainbow/phaser3-rex-notes/issues/572"
},
{
"tags": [
"product"
],
"url": "https://github.com/rexrainbow/phaser3-rex-notes/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-23T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-23T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-08-23T18:05:44.000Z",
"value": "VulDB entry last update"
}
],
"title": "rexrainbow phaser3-rex-notes BehaviorTree Blackboard Data SetValue.js SetValue prototype pollution",
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-78179",
"datePublished": "2026-08-24T03:00:08.841Z",
"dateReserved": "2026-08-23T16:00:39.005Z",
"dateUpdated": "2026-08-24T14:07:14.933Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation
Architecture and Design
Strategy: Refactoring
Refactor your program so that you do not have to dynamically generate code.
Mitigation
Architecture and Design
- Run your code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which code can be executed by your product.
- Examples include the Unix chroot jail and AppArmor. In general, managed code may provide some protection.
- This may not be a feasible solution, and it only limits the impact to the operating system; the rest of your application may still be subject to compromise.
- Be careful to avoid CWE-243 and other weaknesses related to jails.
Mitigation MIT-5
Implementation
Strategy: Input Validation
- Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
- When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
- Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
- To reduce the likelihood of code injection, use stringent allowlists that limit which constructs are allowed. If you are dynamically constructing code that invokes a function, then verifying that the input is alphanumeric might be insufficient. An attacker might still be able to reference a dangerous function that you did not intend to allow, such as system(), exec(), or exit().
Mitigation
Testing
Use dynamic tools and techniques that interact with the product using large test suites with many diverse inputs, such as fuzz testing (fuzzing), robustness testing, and fault injection. The product's operation may slow down, but it should not become unstable, crash, or generate incorrect results.
Mitigation MIT-32
Operation
Strategy: Compilation or Build Hardening
Run the code in an environment that performs automatic taint propagation and prevents any command execution that uses tainted variables, such as Perl's "-T" switch. This will force the program to perform validation steps that remove the taint, although you must be careful to correctly validate your inputs so that you do not accidentally mark dangerous inputs as untainted (see CWE-183 and CWE-184).
Mitigation MIT-32
Operation
Strategy: Environment Hardening
Run the code in an environment that performs automatic taint propagation and prevents any command execution that uses tainted variables, such as Perl's "-T" switch. This will force the program to perform validation steps that remove the taint, although you must be careful to correctly validate your inputs so that you do not accidentally mark dangerous inputs as untainted (see CWE-183 and CWE-184).
Mitigation
Implementation
For Python programs, it is frequently encouraged to use the ast.literal_eval() function instead of eval, since it is intentionally designed to avoid executing code. However, an adversary could still cause excessive memory or stack consumption via deeply nested structures [REF-1372], so the python documentation discourages use of ast.literal_eval() on untrusted data [REF-1373].
CAPEC-242: Code Injection
An adversary exploits a weakness in input validation on the target to inject new code into that which is currently executing. This differs from code inclusion in that code inclusion involves the addition or replacement of a reference to a code file, which is subsequently loaded by the target and used as part of the code of some application.
CAPEC-35: Leverage Executable Code in Non-Executable Files
An attack of this type exploits a system's trust in configuration and resource files. When the executable loads the resource (such as an image file or configuration file) the attacker has modified the file to either execute malicious code directly or manipulate the target process (e.g. application server) to execute based on the malicious configuration parameters. Since systems are increasingly interrelated mashing up resources from local and remote sources the possibility of this attack occurring is high.
CAPEC-77: Manipulating User-Controlled Variables
This attack targets user controlled variables (DEBUG=1, PHP Globals, and So Forth). An adversary can override variables leveraging user-supplied, untrusted query variables directly used on the application server without any data sanitization. In extreme cases, the adversary can change variables controlling the business logic of the application. For instance, in languages like PHP, a number of poorly set default configurations may allow the user to override variables.