{
  "affected": [],
  "aliases": [
    "CVE-2026-27674"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-04-14T00:16:05Z",
    "severity": "MODERATE"
  },
  "details": "Due to a Code Injection vulnerability in SAP NetWeaver Application Server Java (Web Dynpro Java), an unauthenticated attacker could supply crafted input that is interpreted by the application and causes it to reference attacker-controlled content. If a victim accesses the affected functionality, that attacker-controlled content could be executed in the victim\ufffds browser, potentially resulting in session compromise. This could allow the attacker to execute arbitrary client-side code, impacting the confidentiality and integrity of the application, with no impact to availability.",
  "id": "GHSA-2c34-jhww-wwcm",
  "modified": "2026-04-14T00:31:13Z",
  "published": "2026-04-14T00:31:13Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27674"
    },
    {
      "type": "WEB",
      "url": "https://me.sap.com/notes/3719397"
    },
    {
      "type": "WEB",
      "url": "https://url.sap/sapsecuritypatchday"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-42957"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-08-12T03:15:28Z",
    "severity": "CRITICAL"
  },
  "details": "SAP S/4HANA allows an attacker with user privileges to exploit a vulnerability in the function module exposed via RFC. This flaw enables the injection of arbitrary ABAP code into the system, bypassing essential authorization checks. This vulnerability effectively functions as a backdoor, creating the risk of full system compromise, undermining the confidentiality, integrity and availability of the system.",
  "id": "GHSA-2c3g-27ww-4q84",
  "modified": "2025-08-12T03:31:52Z",
  "published": "2025-08-12T03:31:52Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-42957"
    },
    {
      "type": "WEB",
      "url": "https://me.sap.com/notes/3627998"
    },
    {
      "type": "WEB",
      "url": "https://url.sap/sapsecuritypatchday"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-76335"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-19T22:17:17Z",
    "severity": "HIGH"
  },
  "details": "In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an authenticated user who does not hold a role with the edit_manager_xml capability could write a malicious Splunk Web Manager Extensible Markup Language (XML) configuration. When the same user opens the affected Splunk Web Manager page, Splunk Enterprise runs attacker-controlled operating-system commands as the user account running Splunk Enterprise. The vulnerability is possible because Splunk Web does not require the edit_manager_xml capability before accepting Splunk Web Manager XML configuration changes.",
  "id": "GHSA-2c4w-mhg7-79mv",
  "modified": "2026-08-20T00:34:59Z",
  "published": "2026-08-20T00:34:59Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-76335"
    },
    {
      "type": "WEB",
      "url": "https://advisory.splunk.com/advisories/SVD-2026-0801"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2010-4924"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2011-10-09T10:55:00Z",
    "severity": "HIGH"
  },
  "details": "** DISPUTED ** PHP remote file inclusion vulnerability in logic/controller.class.php in clearBudget 0.9.8 allows remote attackers to execute arbitrary PHP code via a URL in the actionPath parameter.  NOTE: this issue has been disputed by a reliable third party.",
  "id": "GHSA-2c5m-w65p-6fhv",
  "modified": "2022-05-17T05:29:53Z",
  "published": "2022-05-17T05:29:53Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-4924"
    },
    {
      "type": "WEB",
      "url": "http://attrition.org/pipermail/vim/2010-August/002388.html"
    },
    {
      "type": "WEB",
      "url": "http://www.exploit-db.com/exploits/14614"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/42351"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 3.1.31"
      },
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.WindowsDesktop.App.Runtime.win-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.1.0"
            },
            {
              "fixed": "3.1.32"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 3.1.31"
      },
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.WindowsDesktop.App.Runtime.win-x86"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.1.0"
            },
            {
              "fixed": "3.1.32"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 6.0.11"
      },
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.WindowsDesktop.App.Runtime.win-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "6.0.0"
            },
            {
              "fixed": "6.0.12"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 6.0.11"
      },
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.WindowsDesktop.App.Runtime.win-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "6.0.0"
            },
            {
              "fixed": "6.0.12"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 6.0.11"
      },
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.WindowsDesktop.App.Runtime.win-x86"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "6.0.0"
            },
            {
              "fixed": "6.0.12"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.WindowsDesktop.App.Runtime.win-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "7.0.0"
            },
            {
              "fixed": "7.0.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "7.0.0"
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.WindowsDesktop.App.Runtime.win-x86"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "7.0.0"
            },
            {
              "fixed": "7.0.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "7.0.0"
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.WindowsDesktop.App.Runtime.win-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "7.0.0"
            },
            {
              "fixed": "7.0.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "7.0.0"
      ]
    }
  ],
  "aliases": [
    "CVE-2022-41089"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-12-14T21:42:00Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "# Microsoft Security Advisory CVE-2022-41089: .NET Remote Code Execution Vulnerability\n\n## \u003ca name=\"executive-summary\"\u003e\u003c/a\u003eExecutive summary\n\nMicrosoft is releasing this security advisory to provide information about a vulnerability in .NET Core 3.1, .NET 6.0., and .NET 7.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.\n\nA remote code execution vulnerability exists in .NET Core 3.1, .NET 6.0, and .NET 7.0, where a malicious actor could cause a user to run arbitrary code as a result of parsing maliciously crafted xps files.\n\n## Announcement\n\nAnnouncement for this issue can be found at https://github.com/dotnet/announcements/issues/242\n\n### \u003ca name=\"mitigation-factors\"\u003e\u003c/a\u003eMitigation factors\n\nMicrosoft has not identified any mitigating factors for this vulnerability.\n\n## \u003ca name=\"affected-software\"\u003e\u003c/a\u003eAffected software\n\n* Any .NET 7.0 WinForms or WPF application running on .NET 7.0.0 or earlier.\n* Any .NET 6.0 WinForms or WPF application running on .NET 6.0.11 or earlier.\n* Any .NET Core 3.1 WinForms or WPF application running on .NET 3.1.31 or earlier.\n\nIf the application does not utilize WinForms or WPF, it is not affected by this vulnerability.\n\nApplications targeting Mac, Linux, Android, iOS, and other non-Windows platforms are not affected by this vulnerability.\n\nIf your application uses the following package versions, ensure you update to the latest version of .NET.\n\n### \u003ca name=\".NET Core 3.1\"\u003e\u003c/a\u003e.NET Core 3.1\n\nPackage name | Affected version | Patched version\n------------ | ---------------- | -------------------------\n[Microsoft.WindowsDesktop.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-x64)|\u003e= 3.1.0, \u003c= 3.1.31|3.1.32\n[Microsoft.WindowsDesktop.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-x86)|\u003e= 3.1.0, \u003c= 3.1.31|3.1.32\n\n### \u003ca name=\".NET 6\"\u003e\u003c/a\u003e.NET 6\n\nPackage name | Affected version | Patched version\n------------ | ---------------- | -------------------------\n[Microsoft.WindowsDesktop.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-arm64)|\u003e= 6.0.0, \u003c= 6.0.11|6.0.12\n[Microsoft.WindowsDesktop.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-x64)|\u003e= 6.0.0, \u003c= 6.0.11|6.0.12\n[Microsoft.WindowsDesktop.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-x86)|\u003e= 6.0.0, \u003c= 6.0.11|6.0.12\n\n### \u003ca name=\".NET 7\"\u003e\u003c/a\u003e.NET 7\n\nPackage name | Affected version | Patched version\n------------ | ---------------- | -------------------------\n[Microsoft.WindowsDesktop.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-arm64)|\u003e= 7.0.0, \u003c= 7.0.0|7.0.1\n[Microsoft.WindowsDesktop.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-x64)|\u003e= 7.0.0, \u003c= 7.0.0|7.0.1\n[Microsoft.WindowsDesktop.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.WindowsDesktop.App.Runtime.win-x86)|\u003e= 7.0.0, \u003c= 7.0.0|7.0.1\n\n## Advisory FAQ\n\n### \u003ca name=\"how-affected\"\u003e\u003c/a\u003eHow do I know if I am affected?\n\nIf you have a runtime or SDK with a version listed, or an affected package listed in [affected software](#affected-software), you\u0027re exposed to the vulnerability.\n\n### \u003ca name=\"how-fix\"\u003e\u003c/a\u003eHow do I fix the issue?\n\n* To fix the issue please install the latest version of .NET 7.0, .NET 6.0 or .NET Core 3.1. If you have installed one or more .NET SDKs through Visual Studio, Visual Studio will prompt you to update Visual Studio, which will also update your .NET  SDKs.\n* If you have .NET Core 3.1 or greater installed, you can list the versions you have installed by running the `dotnet --info` command. You will see output like the following;\n* If you are using one of the affected packages, please update to the patched version listed above. \n\n```\n.NET Core SDK (reflecting any global.json):\n\n Version:   6.0.300\n Commit:    8473146e7d\n\nRuntime Environment:\n\n OS Name:     Windows\n OS Version:  10.0.18363\n OS Platform: Windows\n RID:         win10-x64\n Base Path:   C:\\Program Files\\dotnet\\sdk\\6.0.300\\\n\nHost (useful for support):\n\n  Version: 6.0.5\n  Commit:  8473146e7d\n\n.NET Core SDKs installed:\n\n  6.0.300 [C:\\Program Files\\dotnet\\sdk]\n\n.NET Core runtimes installed:\n\n  Microsoft.AspNetCore.App 6.0.5 [C:\\Program Files\\dotnet\\shared\\Microsoft.AspNetCore.App]\n  Microsoft.NETCore.App 6.0.5 [C:\\Program Files\\dotnet\\shared\\Microsoft.NETCore.App]\n  Microsoft.WindowsDesktop.App 6.0.5 [C:\\Program Files\\dotnet\\shared\\Microsoft.WindowsDesktop.App]\n\nTo install additional .NET Core runtimes or SDKs:\n  https://aka.ms/dotnet-download\n```\n\n* If you\u0027re using .NET 7.0, you should download and install Runtime 7.0.1 or SDK 7.0.101 (for Visual Studio 2022 v17.4) from https://dotnet.microsoft.com/download/dotnet-core/7.0.\n* If you\u0027re using .NET 6.0, you should download and install Runtime 6.0.12 or SDK 6.0.112 (for Visual Studio 2022 v17.1) from https://dotnet.microsoft.com/download/dotnet-core/6.0.\n* If you\u0027re using .NET Core 3.1, you should download and install Runtime 3.1.32 (for Visual Studio 2019 v16.9) from https://dotnet.microsoft.com/download/dotnet-core/3.1.\n\n.NET 7.0, .NET 6.0 and .NET Core 3.1 updates are also available from Microsoft Update. To access this either type \"Check for updates\" in your Windows search, or open Settings, choose Update \u0026 Security and then click Check for Updates.\n\nOnce you have installed the updated runtime or SDK, restart your apps for the update to take effect.\n\nAdditionally, if you\u0027ve deployed [self-contained applications](https://docs.microsoft.com/dotnet/core/deploying/#self-contained-deployments-scd) targeting any of the impacted versions, these applications are also vulnerable and must be recompiled and redeployed.\n\n## Other Information\n\n### Acknowledgements\n\n[Eleftherios Panos](https://twitter.com/lefterispan) with [Nettitude](https://www.nettitude.com/)\n[Nick Landers](https://twitter.com/monoxgas) with NetSPI\n\n### Reporting Security Issues\n\nIf you have found a potential security issue in .NET 7.0, .NET 6.0 or .NET Core 3.1, please email details to secure@microsoft.com. Reports may qualify for the Microsoft .NET Core \u0026 .NET 5 Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at \u003chttps://aka.ms/corebounty\u003e.\n\n### Support\n\nYou can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/runtime and https://github.com/dotnet/wpf/. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue.\n\n### Disclaimer\n\nThe information provided in this advisory is provided \"as is\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.\n\n### External Links\n\n[CVE-2022-41089]( https://www.cve.org/CVERecord?id=CVE-2022-41089)\n\n",
  "id": "GHSA-2c7v-qcjp-4mg2",
  "modified": "2025-01-03T16:00:24Z",
  "published": "2022-12-14T21:42:00Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/dotnet/wpf/security/advisories/GHSA-2c7v-qcjp-4mg2"
    },
    {
      "type": "WEB",
      "url": "https://github.com/dotnet/announcements/issues/242"
    },
    {
      "type": "WEB",
      "url": "https://github.com/dotnet/wpf/commit/5f4c0f7763a06b024c8a517616e0fc0194e997a4"
    },
    {
      "type": "WEB",
      "url": "https://github.com/dotnet/wpf/commit/7b0be4d41c33ce8525d8160bf8869cac10f8a8cd"
    },
    {
      "type": "WEB",
      "url": "https://github.com/dotnet/wpf/commit/c08825a9889e6c798fe95ed5ec1f6a9f517ab5a0"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/dotnet/wpf"
    },
    {
      "type": "WEB",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41089"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": ".NET Remote Code Execution Vulnerability"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "handlebars"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.0.8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "handlebars"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.0.0"
            },
            {
              "fixed": "4.5.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2020-08-31T18:54:52Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "Versions of `handlebars` prior to 3.0.8 or 4.5.2 are vulnerable to Arbitrary Code Execution. The package\u0027s lookup helper fails to properly validate templates, allowing attackers to submit templates that execute arbitrary JavaScript in the system. It can be used to run arbitrary code in a server processing Handlebars templates or on a victim\u0027s browser (effectively serving as Cross-Site Scripting).\n\nThe following template can be used to demonstrate the vulnerability:  \n```{{#with \"constructor\"}}\n\t{{#with split as |a|}}\n\t\t{{pop (push \"alert(\u0027Vulnerable Handlebars JS\u0027);\")}}\n\t\t{{#with (concat (lookup join (slice 0 1)))}}\n\t\t\t{{#each (slice 2 3)}}\n\t\t\t\t{{#with (apply 0 a)}}\n\t\t\t\t\t{{.}}\n\t\t\t\t{{/with}}\n\t\t\t{{/each}}\n\t\t{{/with}}\n\t{{/with}}\n{{/with}}```\n\n\n## Recommendation\n\nUpgrade to version 3.0.8, 4.5.2 or later.",
  "id": "GHSA-2cf5-4w76-r9qv",
  "modified": "2024-01-29T20:54:51Z",
  "published": "2020-09-04T14:57:38Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://www.npmjs.com/advisories/1316"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Arbitrary Code Execution in handlebars"
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-30845"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-04-12T14:15:07Z",
    "severity": "MODERATE"
  },
  "details": "Cross Site Scripting vulnerability in Rainbow external link network disk v.5.5 allows a remote attacker to execute arbitrary code via the validation component of the input parameters.",
  "id": "GHSA-2cmg-2xg7-5x37",
  "modified": "2024-08-21T15:30:49Z",
  "published": "2024-04-12T15:37:21Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-30845"
    },
    {
      "type": "WEB",
      "url": "https://github.com/netcccyun/pan/issues/6"
    },
    {
      "type": "WEB",
      "url": "https://gist.github.com/Zshan7que/c813f2b52daab08c9fb4f6c6b8178b66"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.3.3"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "hydra-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.3.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-68508"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-470",
      "CWE-94"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-21T20:57:31Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "## Summary\n\n`hydra.utils.instantiate()` resolves and calls Python objects from config. If an\napplication passes untrusted config to `instantiate()`, an attacker who controls\n`_target_` and its arguments can cause arbitrary code execution in the consuming\nprocess.\n\nHydra is not a network service. Exploitation requires a consuming application,\nlibrary, or user workflow to load attacker-controlled config, CLI overrides, or\nmodel metadata and pass it to `hydra.utils.instantiate()`.\n\n## Details\n\nHydra\u0027s instantiate API is designed to construct objects and call functions from\nconfiguration. For example:\n\n```yaml\ncomponent:\n  _target_: package.module.Class\n  arg: value\n```\n\nWhen this config is passed to `hydra.utils.instantiate()`, Hydra resolves\n`_target_` and calls it with the provided arguments.\n\nThis is intended for trusted application configuration. However, if untrusted\ninput controls `_target_`, the config becomes a callable-selection mechanism. A\nmalicious config can select a callable capable of executing code or commands and\nprovide attacker-controlled arguments.\n\nThis issue is the same general class of problem discussed by Unit 42 for\ndownstream AI/ML libraries such as NVIDIA NeMo, where untrusted model metadata\nwas passed into Hydra instantiate:\n\nhttps://unit42.paloaltonetworks.com/rce-vulnerabilities-in-ai-python-libraries/\n\nHydra 1.3.4 includes a blacklist for some dangerous `_target_` values. That\nblacklist is defense-in-depth and is not a complete security boundary. The\nblacklist is not present in the released `hydra-core` 1.3.3 package, so this\nissue should not be described as a bypass of a released 1.3.3 blacklist.\n\n## Impact\n\nA successful attack can execute code in the process that calls\n`hydra.utils.instantiate()`. The impact is limited to the privileges and\nenvironment of that process.\n\nPotential impact includes:\n\n- Reading files, credentials, environment variables, or data accessible to the\n  process\n- Modifying files, outputs, checkpoints, or application state writable by the\n  process\n- Terminating or disrupting the process\n\n## Affected Usage\n\nApplications and libraries are affected when they pass untrusted or semi-trusted\nconfig, model metadata, CLI overrides, or other externally controlled data to\n`hydra.utils.instantiate()` without constraining which targets may be\ninstantiated.\n\nTrusted application-owned configuration is not affected in the same way.\n\n## Remediation\n\nHydra 1.3.4 hardens the existing behavior by adding a blacklist of obvious\ndangerous targets. It is a substantial security improvement, and users remaining\non the 1.3 release line should upgrade to 1.3.4 or a newer version.\n\nThe unreleased Hydra 1.4 development line uses an allowlist-based instantiation\nmodel that fully addresses this vulnerability class. The allowlist must come\nfrom trusted application code or another trusted channel, not from the untrusted\nconfig being instantiated.\n\nApplications that consume untrusted or semi-trusted config should not pass it\ndirectly to `hydra.utils.instantiate()`. They should validate `_target_` values\nagainst a trusted allowlist before instantiation.",
  "id": "GHSA-2cp2-2r3c-7p7r",
  "modified": "2026-08-21T20:57:31Z",
  "published": "2026-08-21T20:57:31Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/hydra-ecosystem/hydra/security/advisories/GHSA-2cp2-2r3c-7p7r"
    },
    {
      "type": "WEB",
      "url": "https://github.com/hydra-ecosystem/hydra/issues/3259"
    },
    {
      "type": "WEB",
      "url": "https://github.com/hydra-ecosystem/hydra/pull/3261"
    },
    {
      "type": "WEB",
      "url": "https://github.com/hydra-ecosystem/hydra/commit/7faad0dcedfb4c0a364aa1067c0080fd6fdf8dca"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/hydra-ecosystem/hydra"
    },
    {
      "type": "WEB",
      "url": "https://github.com/hydra-ecosystem/hydra/releases/tag/v1.3.4"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Hydra: hydra.utils.instantiate with untrusted config can lead to code execution"
}

{
  "affected": [],
  "aliases": [
    "CVE-2007-1164"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2007-03-02T21:18:00Z",
    "severity": "HIGH"
  },
  "details": "Multiple PHP remote file inclusion vulnerabilities in DBImageGallery 1.2.2 allow remote attackers to execute arbitrary PHP code via a URL in the donsimg_base_path parameter to (1) attributes.php, (2) images.php, or (3) scan.php in admin/; or (4) attributes.php, (5) db_utils.php, (6) images.php, (7) utils.php, or (8) values.php in includes/.",
  "id": "GHSA-2cq8-phw4-wmvc",
  "modified": "2022-05-01T17:50:52Z",
  "published": "2022-05-01T17:50:52Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2007-1164"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/32612"
    },
    {
      "type": "WEB",
      "url": "https://www.exploit-db.com/exploits/3353"
    },
    {
      "type": "WEB",
      "url": "http://osvdb.org/34937"
    },
    {
      "type": "WEB",
      "url": "http://osvdb.org/34938"
    },
    {
      "type": "WEB",
      "url": "http://osvdb.org/34939"
    },
    {
      "type": "WEB",
      "url": "http://osvdb.org/34940"
    },
    {
      "type": "WEB",
      "url": "http://osvdb.org/34941"
    },
    {
      "type": "WEB",
      "url": "http://osvdb.org/34942"
    },
    {
      "type": "WEB",
      "url": "http://osvdb.org/34943"
    },
    {
      "type": "WEB",
      "url": "http://osvdb.org/34944"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/archive/1/461741/100/0/threaded"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/archive/1/462142/100/0/threaded"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/22657"
    },
    {
      "type": "WEB",
      "url": "http://www.vupen.com/english/advisories/2007/0692"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-22286"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-01-10T14:12:00Z",
    "severity": "HIGH"
  },
  "details": "A vulnerability using PendingIntent in Bixby Routines prior to version 3.1.21.8 in Android R(11.0) and 2.6.30.5 in Android Q(10.0) allows attackers to execute privileged action by hijacking and modifying the intent.",
  "id": "GHSA-2cr4-fx56-fvmc",
  "modified": "2022-01-20T00:02:51Z",
  "published": "2022-01-11T00:00:52Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22286"
    },
    {
      "type": "WEB",
      "url": "https://security.samsungmobile.com/serviceWeb.smsb?year=2022\u0026month=1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}