Common Weakness Enumeration

CWE-94

Allowed-with-Review

Improper Control of Generation of Code ('Code Injection')

Abstraction: Base · Status: Draft

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

9544 vulnerabilities reference this CWE, most recent first.

CVE-2026-108598 (GCVE-0-2026-108598)

Vulnerability from cvelistv5 – Published: 2026-10-10 18:58 – Updated: 2026-10-13 11:41

Title

Floci 1.1.0 before 2.2.0 RCE via API Gateway VTL Mapping Templates

Summary

Floci 1.1.0 before 2.2.0 contains a code injection vulnerability in VtlTemplateEngine that allows unauthenticated attackers to execute commands via unrestricted Velocity mapping templates. Attackers can create a REST API with a MOCK integration whose template uses $util reflection to reach Runtime or ProcessBuilder, executing OS commands in the Floci JVM.

Severity

9.3 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: poc Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-13 11:39 UTC

CWE

CWE-94 - Improper Control of Generation of Code ('Code Injection')

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 6373 records in the last 180 days details

References

7 references

URL	Tags
https://github.com/floci-io/floci/security/adviso…	vendor-advisory
https://github.com/ghostx-86/exploitarium/tree/ma…	exploit
https://github.com/floci-io/floci/commit/144b90e6…	patch
https://github.com/floci-io/floci/releases/tag/2.2.0	release-notes
https://github.com/floci-io/floci/blob/560b3e4aae…	technical-description
https://github.com/floci-io/floci	product
https://www.vulncheck.com/advisories/floci-1.1.0-…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
floci-io	floci	Affected: 1.1.0 , < 2.2.0 (semver)

Date Public

2026-06-27 00:00

Credits

Muhammad Ali Hasan Anwar Wael-Rd

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-108598",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-13T11:39:38.007624Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-13T11:41:41.376Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/floci-io/floci",
          "product": "floci",
          "repo": "https://github.com/floci-io/floci",
          "vendor": "floci-io",
          "versions": [
            {
              "lessThan": "2.2.0",
              "status": "affected",
              "version": "1.1.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Muhammad Ali"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Hasan Anwar"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Wael-Rd"
        }
      ],
      "datePublic": "2026-06-27T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Floci 1.1.0 before 2.2.0 contains a code injection vulnerability in VtlTemplateEngine that allows unauthenticated attackers to execute commands via unrestricted Velocity mapping templates. Attackers can create a REST API with a MOCK integration whose template uses $util reflection to reach Runtime or ProcessBuilder, executing OS commands in the Floci JVM."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-10T18:58:14.825Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-3p4c-wp7w-mgjx)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/floci-io/floci/security/advisories/GHSA-3p4c-wp7w-mgjx"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://github.com/ghostx-86/exploitarium/tree/main/floci-apigateway-vtl-rce-poc"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/floci-io/floci/commit/144b90e6fa861a5ac882e99a090d503da01945c4"
        },
        {
          "name": "floci 2.2.0 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/floci-io/floci/releases/tag/2.2.0"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/floci-io/floci/blob/560b3e4aae61cea3ac7d4d51843bdffd0e3085fd/src/main/java/io/github/hectorvent/floci/services/apigateway/VtlTemplateEngine.java#L74-L114"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/floci-io/floci"
        },
        {
          "name": "VulnCheck Advisory: Floci 1.1.0 before 2.2.0 RCE via API Gateway VTL Mapping Templates",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/floci-1.1.0-before-2.2.0-rce-via-api-gateway-vtl-mapping-templates"
        }
      ],
      "title": "Floci 1.1.0 before 2.2.0 RCE via API Gateway VTL Mapping Templates",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-108598",
    "datePublished": "2026-10-10T18:58:14.825Z",
    "dateReserved": "2026-10-10T18:25:14.522Z",
    "dateUpdated": "2026-10-13T11:41:41.376Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-108593 (GCVE-0-2026-108593)

Vulnerability from cvelistv5 – Published: 2026-10-10 18:16 – Updated: 2026-10-13 11:38

Title

9router 0.4.1 through 0.5.99 Config Injection RCE via hermes-settings Endpoint

Summary

9router 0.4.1 through 0.5.99 contains a configuration injection vulnerability in the POST /api/cli-tools/hermes-settings endpoint that allows authenticated dashboard users to inject arbitrary keys into the Hermes Agent config.yaml file. Attackers can submit a baseUrl containing double quotes and newlines to add hooks_auto_accept and a hooks.post_llm_call shell command, which Hermes Agent executes without approval after an LLM call.

Severity

7.3 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

6.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-13 11:37 UTC

CWE

CWE-94 - Improper Control of Generation of Code ('Code Injection')

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 6373 records in the last 180 days details

References

5 references

URL	Tags
https://hackmd.io/@haind/9router-hermes-config-in…	third-party-advisory
https://github.com/decolua/9router/blob/a99cf5723…	technical-description
https://github.com/decolua/9router/blob/a99cf5723…	technical-description
https://github.com/decolua/9router	product
https://www.vulncheck.com/advisories/9router-0.4.…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
decolua	9router	Affected: 0.4.1 , ≤ 0.5.99 (semver)

Date Public

2026-10-09 00:00

Credits

HaiND from the Post and Telecommunication Institute of Technology

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-108593",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-13T11:37:50.670875Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-13T11:38:18.277Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://hackmd.io/@haind/9router-hermes-config-injection"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://registry.npmjs.org",
          "defaultStatus": "unaffected",
          "packageURL": "pkg:npm/9router",
          "product": "9router",
          "repo": "https://github.com/decolua/9router",
          "vendor": "decolua",
          "versions": [
            {
              "lessThanOrEqual": "0.5.99",
              "status": "affected",
              "version": "0.4.1",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "HaiND from the Post and Telecommunication Institute of Technology"
        }
      ],
      "datePublic": "2026-10-09T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "9router 0.4.1 through 0.5.99 contains a configuration injection vulnerability in the POST /api/cli-tools/hermes-settings endpoint that allows authenticated dashboard users to inject arbitrary keys into the Hermes Agent config.yaml file. Attackers can submit a baseUrl containing double quotes and newlines to add hooks_auto_accept and a hooks.post_llm_call shell command, which Hermes Agent executes without approval after an LLM call."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "privilegesRequired": "HIGH",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-10T18:16:57.203Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://hackmd.io/@haind/9router-hermes-config-injection"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/decolua/9router/blob/a99cf57239ff778b61e434c2786009d5ed1c412c/src/app/api/cli-tools/hermes-settings/route.js#L20-L35"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/decolua/9router/blob/a99cf57239ff778b61e434c2786009d5ed1c412c/src/app/api/cli-tools/hermes-settings/route.js#L185-L223"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/decolua/9router"
        },
        {
          "name": "VulnCheck Advisory: 9router 0.4.1 through 0.5.99 Config Injection RCE via hermes-settings Endpoint",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/9router-0.4.1-through-0.5.99-config-injection-rce-via-hermes-settings-endpoint"
        }
      ],
      "title": "9router 0.4.1 through 0.5.99 Config Injection RCE via hermes-settings Endpoint",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-108593",
    "datePublished": "2026-10-10T18:16:57.203Z",
    "dateReserved": "2026-10-10T18:08:11.797Z",
    "dateUpdated": "2026-10-13T11:38:18.277Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-108566 (GCVE-0-2026-108566)

Vulnerability from cvelistv5 – Published: 2026-10-11 09:15 – Updated: 2026-10-13 13:01 X_Open Source

Title

InstantSoft icms2 Private Message index.tpl.php index cross site scripting

Summary

A vulnerability has been found in InstantSoft icms2 up to 2.18.2. This issue affects the function index of the file templates/default/controllers/messages/index.tpl.php of the component Private Message Handler. Such manipulation of the argument nickname leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 3a1ec8fcb073a46d06a2ab83bc2bf68225834281. It is best practice to apply a patch to resolve this issue.

Severity

5.1 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P

3.5 (Low)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C

3.5 (Low)


                        
                          CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-13 13:00 UTC

CWE

CWE-79 - Cross Site Scripting
CWE-94 - Code Injection

Assigner

VulDB CNA under the mitre root

CNA scorecard B 82/100 over 3832 records in the last 180 days details

References

6 references

URL	Tags
https://vuldb.com/vuln/416223	vdb-entrytechnical-description
https://vuldb.com/vuln/416223/cti	signaturepermissions-required
https://vuldb.com/cve/CVE-2026-108566	third-party-advisory
https://vuldb.com/submit/954247	third-party-advisory
https://github.com/instantsoft/icms2/commit/3a1ec…	patch
https://github.com/instantsoft/icms2/	product

Impacted products

1 product

Vendor	Product	Version
InstantSoft	icms2	Affected: 2.18.0 Affected: 2.18.1 Affected: 2.18.2 cpe:2.3:a:instantsoft:icms2::::::::

Credits

EVIL0RD (VulDB User) VulDB Vulnerability Moderation Team

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-108566",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-13T13:00:51.951525Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-13T13:01:20.117Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://vuldb.com/submit/954247"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:instantsoft:icms2:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "Private Message Handler"
          ],
          "product": "icms2",
          "vendor": "InstantSoft",
          "versions": [
            {
              "status": "affected",
              "version": "2.18.0"
            },
            {
              "status": "affected",
              "version": "2.18.1"
            },
            {
              "status": "affected",
              "version": "2.18.2"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "EVIL0RD (VulDB User)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "VulDB Vulnerability Moderation Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability has been found in InstantSoft icms2 up to 2.18.2. This issue affects the function index of the file templates/default/controllers/messages/index.tpl.php of the component Private Message Handler. Such manipulation of the argument nickname leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 3a1ec8fcb073a46d06a2ab83bc2bf68225834281. It is best practice to apply a patch to resolve this issue."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 3.5,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 3.5,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 4,
            "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:OF/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "Cross Site Scripting",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "Code Injection",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-11T09:15:16.508Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-416223 | InstantSoft icms2 Private Message index.tpl.php index cross site scripting",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/416223"
        },
        {
          "name": "VDB-416223 | CTI Indicators (IOB, IOC, TTP, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/416223/cti"
        },
        {
          "name": "CVE-2026-108566 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-108566"
        },
        {
          "name": "Submit #954247 | InstantCMS InstantCMS icms2 2.18.2 Cross-Site Scripting (XSS)",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/954247"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/instantsoft/icms2/commit/3a1ec8fcb073a46d06a2ab83bc2bf68225834281"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/instantsoft/icms2/"
        }
      ],
      "tags": [
        "x_open-source"
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-10T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-10-10T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-10-10T17:09:29.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "InstantSoft icms2 Private Message index.tpl.php index cross site scripting",
      "x_generator": [
        "VulDB PVTS v202610"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-108566",
    "datePublished": "2026-10-11T09:15:16.508Z",
    "dateReserved": "2026-10-10T15:04:16.038Z",
    "dateUpdated": "2026-10-13T13:01:20.117Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-108551 (GCVE-0-2026-108551)

Vulnerability from cvelistv5 – Published: 2026-10-10 14:35 – Updated: 2026-10-13 18:27

Title

openapi-typescript-codegen through 0.31.0 Code Injection via Handlebars Templates

Summary

openapi-typescript-codegen through 0.31.0 contains a code injection vulnerability that allows attackers controlling an OpenAPI document to inject JavaScript by supplying unescaped values interpolated into single-quoted string literals. Attackers can embed a single quote in path keys, parameter names, servers[0].url, or info.version to execute arbitrary JavaScript when generated clients are imported or service methods called.

Severity

9.3 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-13 18:27 UTC

CWE

CWE-94 - Improper Control of Generation of Code ('Code Injection')

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 6373 records in the last 180 days details

References

5 references

URL	Tags
https://github.com/ferdikoomen/openapi-typescript…	issue-tracking
https://github.com/ferdikoomen/openapi-typescript…	product
https://github.com/ferdikoomen/openapi-typescript…	technical-description
https://github.com/ferdikoomen/openapi-typescript…	technical-description
https://www.vulncheck.com/advisories/openapi-type…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
ferdikoomen	openapi-typescript-codegen	Affected: 0 , ≤ 0.31.0 (semver)

Date Public

2026-09-04 00:00

Credits

George Chen

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-108551",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-13T18:27:39.102462Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-13T18:27:49.183Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:npm/openapi-typescript-codegen",
          "product": "openapi-typescript-codegen",
          "vendor": "ferdikoomen",
          "versions": [
            {
              "lessThanOrEqual": "0.31.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "George Chen"
        }
      ],
      "datePublic": "2026-09-04T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "openapi-typescript-codegen through 0.31.0 contains a code injection vulnerability that allows attackers controlling an OpenAPI document to inject JavaScript by supplying unescaped values interpolated into single-quoted string literals. Attackers can embed a single quote in path keys, parameter names, servers[0].url, or info.version to execute arbitrary JavaScript when generated clients are imported or service methods called."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-10T14:35:05.552Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Issue #2809",
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/ferdikoomen/openapi-typescript-codegen/issues/2809"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/ferdikoomen/openapi-typescript-codegen"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/ferdikoomen/openapi-typescript-codegen/blob/v0.31.0/src/templates/exportService.hbs#L89-L110"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/ferdikoomen/openapi-typescript-codegen/blob/v0.31.0/src/templates/core/OpenAPI.hbs#L20-L23"
        },
        {
          "name": "VulnCheck Advisory: openapi-typescript-codegen through 0.31.0 Code Injection via Handlebars Templates",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/openapi-typescript-codegen-through-0.31.0-code-injection-via-handlebars-templates"
        }
      ],
      "title": "openapi-typescript-codegen through 0.31.0 Code Injection via Handlebars Templates",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-108551",
    "datePublished": "2026-10-10T14:35:05.552Z",
    "dateReserved": "2026-10-10T14:24:43.582Z",
    "dateUpdated": "2026-10-13T18:27:49.183Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-108390 (GCVE-0-2026-108390)

Vulnerability from cvelistv5 – Published: 2026-10-14 17:17 – Updated: 2026-10-14 17:54

Title

HestiaCP Low-Privileged User to Root via Config-Field Injection and PATH Hijacking

Summary

Hestia Control Panel is a lightweight and powerful control panel for the modern web. From version 1.9.7 through 1.10.4, update_object_value() in func/main.sh does not escape single quotes when writing a custom document-root value to a user's web.conf file, allowing a low-privileged authenticated panel user with a web domain to inject an additional PATH field. When the user invokes the ordinary Search feature, the root-privileged v-search-user-object script loads the forged field through parse_object_kv_list_non_eval(), which permits reserved shell-variable names and globally replaces PATH before invoking column without an absolute path. By placing a malicious column executable in the injected search path, the user can execute arbitrary code as root. This residual vulnerability was introduced when version 1.9.7 replaced the raw eval sink addressed by CVE-2026-84984 with parse_object_kv_list_non_eval(), and it is fixed in version 1.10.5.

Severity

9.9 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-14 17:49 UTC

CWE

CWE-88 - Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
CWE-94 - Improper Control of Generation of Code ('Code Injection')
CWE-427 - Uncontrolled Search Path Element

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7771 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/hestiacp/hestiacp/security/adv…	x_refsource_CONFIRM
https://github.com/hestiacp/hestiacp/commit/4d860…	x_refsource_MISC
https://ravindulakmina.pages.dev/advisories/cve-2…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
hestiacp	hestiacp	Affected: >= 1.9.7, < 1.10.5

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-108390",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-14T17:49:42.111046Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-14T17:50:14.820Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/hestiacp/hestiacp/security/advisories/GHSA-r9q4-pmcm-5qqf"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "hestiacp",
          "vendor": "hestiacp",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.9.7, \u003c 1.10.5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Hestia Control Panel is a lightweight and powerful control panel for the modern web. From version 1.9.7 through 1.10.4, update_object_value() in func/main.sh does not escape single quotes when writing a custom document-root value to a user\u0027s web.conf file, allowing a low-privileged authenticated panel user with a web domain to inject an additional PATH field. When the user invokes the ordinary Search feature, the root-privileged v-search-user-object script loads the forged field through parse_object_kv_list_non_eval(), which permits reserved shell-variable names and globally replaces PATH before invoking column without an absolute path. By placing a malicious column executable in the injected search path, the user can execute arbitrary code as root. This residual vulnerability was introduced when version 1.9.7 replaced the raw eval sink addressed by CVE-2026-84984 with parse_object_kv_list_non_eval(), and it is fixed in version 1.10.5."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.9,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-88",
              "description": "CWE-88: Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-427",
              "description": "CWE-427: Uncontrolled Search Path Element",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-14T17:54:41.782Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/hestiacp/hestiacp/security/advisories/GHSA-r9q4-pmcm-5qqf",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/hestiacp/hestiacp/security/advisories/GHSA-r9q4-pmcm-5qqf"
        },
        {
          "name": "https://github.com/hestiacp/hestiacp/commit/4d86018660f35a1d64a0ae819bc5ee700949a287",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/hestiacp/hestiacp/commit/4d86018660f35a1d64a0ae819bc5ee700949a287"
        },
        {
          "name": "https://ravindulakmina.pages.dev/advisories/cve-2026-108390-hestiacp-apostrophe-to-root",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://ravindulakmina.pages.dev/advisories/cve-2026-108390-hestiacp-apostrophe-to-root"
        }
      ],
      "source": {
        "advisory": "GHSA-r9q4-pmcm-5qqf",
        "discovery": "UNKNOWN"
      },
      "title": "HestiaCP Low-Privileged User to Root via Config-Field Injection and PATH Hijacking"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-108390",
    "datePublished": "2026-10-14T17:17:24.180Z",
    "dateReserved": "2026-10-09T21:36:27.043Z",
    "dateUpdated": "2026-10-14T17:54:41.782Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-108385 (GCVE-0-2026-108385)

Vulnerability from cvelistv5 – Published: 2026-10-13 17:56 – Updated: 2026-10-13 18:15

Title

dataclasses-avroschema enum symbols can inject statements through generated member names

Summary

dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, BaseGenerator.parse_enum and EnumRepresentation.render_symbols use each schema-controlled enum symbol as a generated enum member name after case conversion but without validating it as an identifier. When generator classes are used directly, newlines and punctuation can inject constrained statements into the generated enum class body, allowing namespace modification or preventing the module from loading. Version 0.70.6 fixes the vulnerability by validating every enum symbol as a name.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-13 18:15 UTC

CWE

CWE-94 - Improper Control of Generation of Code ('Code Injection')

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7771 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/marcosschroh/dataclasses-avros…	x_refsource_CONFIRM
https://github.com/marcosschroh/dataclasses-avros…	x_refsource_MISC
https://github.com/marcosschroh/dataclasses-avros…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
marcosschroh	dataclasses-avroschema	Affected: >= 0.38.0, < 0.70.6

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-108385",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-13T18:15:24.109413Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-13T18:15:58.645Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/marcosschroh/dataclasses-avroschema/security/advisories/GHSA-gw6w-pvv9-2fqc"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "dataclasses-avroschema",
          "vendor": "marcosschroh",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 0.38.0, \u003c 0.70.6"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, BaseGenerator.parse_enum and EnumRepresentation.render_symbols use each schema-controlled enum symbol as a generated enum member name after case conversion but without validating it as an identifier. When generator classes are used directly, newlines and punctuation can inject constrained statements into the generated enum class body, allowing namespace modification or preventing the module from loading. Version 0.70.6 fixes the vulnerability by validating every enum symbol as a name."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-13T17:56:31.399Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/marcosschroh/dataclasses-avroschema/security/advisories/GHSA-gw6w-pvv9-2fqc",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/marcosschroh/dataclasses-avroschema/security/advisories/GHSA-gw6w-pvv9-2fqc"
        },
        {
          "name": "https://github.com/marcosschroh/dataclasses-avroschema/commit/429f3d705d2d04c0c65e2ef832daed5ff91318fc",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/marcosschroh/dataclasses-avroschema/commit/429f3d705d2d04c0c65e2ef832daed5ff91318fc"
        },
        {
          "name": "https://github.com/marcosschroh/dataclasses-avroschema/releases/tag/0.70.6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/marcosschroh/dataclasses-avroschema/releases/tag/0.70.6"
        }
      ],
      "source": {
        "advisory": "GHSA-gw6w-pvv9-2fqc",
        "discovery": "UNKNOWN"
      },
      "title": "dataclasses-avroschema enum symbols can inject statements through generated member names"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-108385",
    "datePublished": "2026-10-13T17:56:31.399Z",
    "dateReserved": "2026-10-09T21:36:27.043Z",
    "dateUpdated": "2026-10-13T18:15:58.645Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-108384 (GCVE-0-2026-108384)

Vulnerability from cvelistv5 – Published: 2026-10-13 17:53 – Updated: 2026-10-13 20:21

Title

dataclasses-avroschema allows code injection through fixed-type aliases supplied as a bare string

Summary

dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, BaseGenerator.parse_fixed interpolates a fixed type's aliases value directly into a generated types.confixed annotation. A list is represented with quoted entries, but a bare string is emitted as an unquoted Python expression and evaluated when the generated module is imported, allowing arbitrary code execution from a crafted schema. Version 0.70.6 fixes the vulnerability by rejecting aliases values that are not lists.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-13 20:14 UTC

CWE

CWE-94 - Improper Control of Generation of Code ('Code Injection')

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7771 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/marcosschroh/dataclasses-avros…	x_refsource_CONFIRM
https://github.com/marcosschroh/dataclasses-avros…	x_refsource_MISC
https://github.com/marcosschroh/dataclasses-avros…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
marcosschroh	dataclasses-avroschema	Affected: >= 0.38.0, < 0.70.6

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-108384",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-13T20:14:08.820272Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-13T20:21:19.992Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "dataclasses-avroschema",
          "vendor": "marcosschroh",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 0.38.0, \u003c 0.70.6"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, BaseGenerator.parse_fixed interpolates a fixed type\u0027s aliases value directly into a generated types.confixed annotation. A list is represented with quoted entries, but a bare string is emitted as an unquoted Python expression and evaluated when the generated module is imported, allowing arbitrary code execution from a crafted schema. Version 0.70.6 fixes the vulnerability by rejecting aliases values that are not lists."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-13T17:53:48.228Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/marcosschroh/dataclasses-avroschema/security/advisories/GHSA-8j5c-xq6f-2c43",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/marcosschroh/dataclasses-avroschema/security/advisories/GHSA-8j5c-xq6f-2c43"
        },
        {
          "name": "https://github.com/marcosschroh/dataclasses-avroschema/commit/429f3d705d2d04c0c65e2ef832daed5ff91318fc",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/marcosschroh/dataclasses-avroschema/commit/429f3d705d2d04c0c65e2ef832daed5ff91318fc"
        },
        {
          "name": "https://github.com/marcosschroh/dataclasses-avroschema/releases/tag/0.70.6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/marcosschroh/dataclasses-avroschema/releases/tag/0.70.6"
        }
      ],
      "source": {
        "advisory": "GHSA-8j5c-xq6f-2c43",
        "discovery": "UNKNOWN"
      },
      "title": "dataclasses-avroschema allows code injection through fixed-type aliases supplied as a bare string"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-108384",
    "datePublished": "2026-10-13T17:53:48.228Z",
    "dateReserved": "2026-10-09T21:36:27.043Z",
    "dateUpdated": "2026-10-13T20:21:19.992Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-108383 (GCVE-0-2026-108383)

Vulnerability from cvelistv5 – Published: 2026-10-13 17:47 – Updated: 2026-10-14 15:58

Title

dataclasses-avroschema enum field defaults can inject statements into generated modules

Summary

dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, FieldRepresentation.get_field_default renders a schema-controlled enum field default as an enum member reference after applying case conversion but without validating it as an identifier. Newlines, operators, and punctuation can escape the intended reference and inject constrained statements into the generated module, allowing namespace modification or preventing the module from loading. Version 0.70.6 fixes the vulnerability by validating enum defaults as names.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-14 15:56 UTC

CWE

CWE-94 - Improper Control of Generation of Code ('Code Injection')

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7771 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/marcosschroh/dataclasses-avros…	x_refsource_CONFIRM
https://github.com/marcosschroh/dataclasses-avros…	x_refsource_MISC
https://github.com/marcosschroh/dataclasses-avros…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
marcosschroh	dataclasses-avroschema	Affected: >= 0.38.0, < 0.70.6

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-108383",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-14T15:56:50.792415Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-14T15:58:33.201Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/marcosschroh/dataclasses-avroschema/security/advisories/GHSA-4xxf-mv22-hcr8"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "dataclasses-avroschema",
          "vendor": "marcosschroh",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 0.38.0, \u003c 0.70.6"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, FieldRepresentation.get_field_default renders a schema-controlled enum field default as an enum member reference after applying case conversion but without validating it as an identifier. Newlines, operators, and punctuation can escape the intended reference and inject constrained statements into the generated module, allowing namespace modification or preventing the module from loading. Version 0.70.6 fixes the vulnerability by validating enum defaults as names."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-13T17:47:51.594Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/marcosschroh/dataclasses-avroschema/security/advisories/GHSA-4xxf-mv22-hcr8",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/marcosschroh/dataclasses-avroschema/security/advisories/GHSA-4xxf-mv22-hcr8"
        },
        {
          "name": "https://github.com/marcosschroh/dataclasses-avroschema/commit/429f3d705d2d04c0c65e2ef832daed5ff91318fc",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/marcosschroh/dataclasses-avroschema/commit/429f3d705d2d04c0c65e2ef832daed5ff91318fc"
        },
        {
          "name": "https://github.com/marcosschroh/dataclasses-avroschema/releases/tag/0.70.6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/marcosschroh/dataclasses-avroschema/releases/tag/0.70.6"
        }
      ],
      "source": {
        "advisory": "GHSA-4xxf-mv22-hcr8",
        "discovery": "UNKNOWN"
      },
      "title": "dataclasses-avroschema enum field defaults can inject statements into generated modules"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-108383",
    "datePublished": "2026-10-13T17:47:51.594Z",
    "dateReserved": "2026-10-09T21:36:27.043Z",
    "dateUpdated": "2026-10-14T15:58:33.201Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-108382 (GCVE-0-2026-108382)

Vulnerability from cvelistv5 – Published: 2026-10-13 17:44 – Updated: 2026-10-13 18:00

Title

dataclasses-avroschema allows code injection through generated enum-symbol string literals

Summary

dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, EnumRepresentation.render_symbols concatenates each schema-controlled enum symbol between double quotes in a generated enum assignment. When generator classes are used directly, a quote can terminate the string literal and inject arbitrary Python code into the enum class body, which executes when the generated module is imported. Version 0.70.6 fixes the vulnerability by escaping enum symbol values before rendering them.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-13 18:00 UTC

CWE

CWE-94 - Improper Control of Generation of Code ('Code Injection')

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7771 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/marcosschroh/dataclasses-avros…	x_refsource_CONFIRM
https://github.com/marcosschroh/dataclasses-avros…	x_refsource_MISC
https://github.com/marcosschroh/dataclasses-avros…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
marcosschroh	dataclasses-avroschema	Affected: >= 0.38.0, < 0.70.6

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-108382",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-13T18:00:18.850453Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-13T18:00:34.900Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/marcosschroh/dataclasses-avroschema/security/advisories/GHSA-vrq9-94ww-jv3c"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "dataclasses-avroschema",
          "vendor": "marcosschroh",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 0.38.0, \u003c 0.70.6"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, EnumRepresentation.render_symbols concatenates each schema-controlled enum symbol between double quotes in a generated enum assignment. When generator classes are used directly, a quote can terminate the string literal and inject arbitrary Python code into the enum class body, which executes when the generated module is imported. Version 0.70.6 fixes the vulnerability by escaping enum symbol values before rendering them."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-13T17:44:36.222Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/marcosschroh/dataclasses-avroschema/security/advisories/GHSA-vrq9-94ww-jv3c",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/marcosschroh/dataclasses-avroschema/security/advisories/GHSA-vrq9-94ww-jv3c"
        },
        {
          "name": "https://github.com/marcosschroh/dataclasses-avroschema/commit/429f3d705d2d04c0c65e2ef832daed5ff91318fc",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/marcosschroh/dataclasses-avroschema/commit/429f3d705d2d04c0c65e2ef832daed5ff91318fc"
        },
        {
          "name": "https://github.com/marcosschroh/dataclasses-avroschema/releases/tag/0.70.6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/marcosschroh/dataclasses-avroschema/releases/tag/0.70.6"
        }
      ],
      "source": {
        "advisory": "GHSA-vrq9-94ww-jv3c",
        "discovery": "UNKNOWN"
      },
      "title": "dataclasses-avroschema allows code injection through generated enum-symbol string literals"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-108382",
    "datePublished": "2026-10-13T17:44:36.222Z",
    "dateReserved": "2026-10-09T21:36:27.043Z",
    "dateUpdated": "2026-10-13T18:00:34.900Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-108381 (GCVE-0-2026-108381)

Vulnerability from cvelistv5 – Published: 2026-10-13 17:43 – Updated: 2026-10-16 22:23

Title

dataclasses-avroschema pydantic-class metadata allows code injection in generated annotations

Summary

dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.44.0 through 0.70.5, the Pydantic and AvroDantic model generators insert a schema field's pydantic-class value after pydantic. in a generated field annotation without safely restricting the expression. Because annotations are evaluated when the generated module is imported, a crafted value can execute arbitrary Python code. Version 0.70.6 fixes the vulnerability by restricting the value to a bare name or a call to a bare name with literal arguments.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-16 22:23 UTC

CWE

CWE-94 - Improper Control of Generation of Code ('Code Injection')

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7771 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/marcosschroh/dataclasses-avros…	x_refsource_CONFIRM
https://github.com/marcosschroh/dataclasses-avros…	x_refsource_MISC
https://github.com/marcosschroh/dataclasses-avros…	x_refsource_MISC
https://github.com/marcosschroh/dataclasses-avros…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
marcosschroh	dataclasses-avroschema	Affected: >= 0.44.0, < 0.70.6

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-108381",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T22:23:33.270887Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-16T22:23:59.982Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/marcosschroh/dataclasses-avroschema/security/advisories/GHSA-4jmx-9m83-vxx8"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "dataclasses-avroschema",
          "vendor": "marcosschroh",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 0.44.0, \u003c 0.70.6"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.44.0 through 0.70.5, the Pydantic and AvroDantic model generators insert a schema field\u0027s pydantic-class value after pydantic. in a generated field annotation without safely restricting the expression. Because annotations are evaluated when the generated module is imported, a crafted value can execute arbitrary Python code. Version 0.70.6 fixes the vulnerability by restricting the value to a bare name or a call to a bare name with literal arguments."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-13T17:43:11.422Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/marcosschroh/dataclasses-avroschema/security/advisories/GHSA-4jmx-9m83-vxx8",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/marcosschroh/dataclasses-avroschema/security/advisories/GHSA-4jmx-9m83-vxx8"
        },
        {
          "name": "https://github.com/marcosschroh/dataclasses-avroschema/pull/358",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/marcosschroh/dataclasses-avroschema/pull/358"
        },
        {
          "name": "https://github.com/marcosschroh/dataclasses-avroschema/commit/429f3d705d2d04c0c65e2ef832daed5ff91318fc",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/marcosschroh/dataclasses-avroschema/commit/429f3d705d2d04c0c65e2ef832daed5ff91318fc"
        },
        {
          "name": "https://github.com/marcosschroh/dataclasses-avroschema/releases/tag/0.70.6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/marcosschroh/dataclasses-avroschema/releases/tag/0.70.6"
        }
      ],
      "source": {
        "advisory": "GHSA-4jmx-9m83-vxx8",
        "discovery": "UNKNOWN"
      },
      "title": "dataclasses-avroschema pydantic-class metadata allows code injection in generated annotations"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-108381",
    "datePublished": "2026-10-13T17:43:11.422Z",
    "dateReserved": "2026-10-09T21:36:27.043Z",
    "dateUpdated": "2026-10-16T22:23:59.982Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Mitigation

Architecture and Design

Strategy: Refactoring

Refactor your program so that you do not have to dynamically generate code.

Mitigation

Architecture and Design

Run your code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which code can be executed by your product.
Examples include the Unix chroot jail and AppArmor. In general, managed code may provide some protection.
This may not be a feasible solution, and it only limits the impact to the operating system; the rest of your application may still be subject to compromise.
Be careful to avoid CWE-243 and other weaknesses related to jails.

Mitigation MIT-5

Implementation

Strategy: Input Validation

Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
To reduce the likelihood of code injection, use stringent allowlists that limit which constructs are allowed. If you are dynamically constructing code that invokes a function, then verifying that the input is alphanumeric might be insufficient. An attacker might still be able to reference a dangerous function that you did not intend to allow, such as system(), exec(), or exit().

Mitigation

Testing

Use dynamic tools and techniques that interact with the product using large test suites with many diverse inputs, such as fuzz testing (fuzzing), robustness testing, and fault injection. The product's operation may slow down, but it should not become unstable, crash, or generate incorrect results.

Mitigation MIT-32

Operation

Strategy: Compilation or Build Hardening

Run the code in an environment that performs automatic taint propagation and prevents any command execution that uses tainted variables, such as Perl's "-T" switch. This will force the program to perform validation steps that remove the taint, although you must be careful to correctly validate your inputs so that you do not accidentally mark dangerous inputs as untainted (see CWE-183 and CWE-184).

Mitigation MIT-32

Operation

Strategy: Environment Hardening

Mitigation

Implementation

For Python programs, it is frequently encouraged to use the ast.literal_eval() function instead of eval, since it is intentionally designed to avoid executing code. However, an adversary could still cause excessive memory or stack consumption via deeply nested structures [REF-1372], so the python documentation discourages use of ast.literal_eval() on untrusted data [REF-1373].

CAPEC-242: Code Injection

An adversary exploits a weakness in input validation on the target to inject new code into that which is currently executing. This differs from code inclusion in that code inclusion involves the addition or replacement of a reference to a code file, which is subsequently loaded by the target and used as part of the code of some application.

CAPEC-35: Leverage Executable Code in Non-Executable Files

An attack of this type exploits a system's trust in configuration and resource files. When the executable loads the resource (such as an image file or configuration file) the attacker has modified the file to either execute malicious code directly or manipulate the target process (e.g. application server) to execute based on the malicious configuration parameters. Since systems are increasingly interrelated mashing up resources from local and remote sources the possibility of this attack occurring is high.

CAPEC-77: Manipulating User-Controlled Variables

This attack targets user controlled variables (DEBUG=1, PHP Globals, and So Forth). An adversary can override variables leveraging user-supplied, untrusted query variables directly used on the application server without any data sanitization. In extreme cases, the adversary can change variables controlling the business logic of the application. For instance, in languages like PHP, a number of poorly set default configurations may allow the user to override variables.

← Back to the CWE list