# Code injection.

Untrusted input evaluated as code: eval, templates, expression languages. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [Frappe Framework ERPNext 13.4.0 Remote Code Execution](https://agentprime.io/advisories/CVE-2023-54345.md)
  `CVE-2023-54345` · CVE record: Frappe Technologies Frappe Framework (ERPNext) · CVSS 8.7 High · Not analysed yet · Published 5 May 2026 · Tags: Code injection
- [ERPNext v15.103.1 and before is vulnerable to Server-Side Template Injection (SSTI).](https://agentprime.io/advisories/CVE-2026-38431.md)
  `CVE-2026-38431` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 May 2026 · Tags: Code injection
- [AzuraCast Vulnerable to Liquidsoap Code Injection via Incomplete cleanUpString-to-toRawString Migration in Remote Relay Password Field](https://agentprime.io/advisories/GHSA-q4ph-8x8g-95f8.md)
  `GHSA-q4ph-8x8g-95f8`, `CVE-2026-100856`, `PKSA-wgbn-7zcq-1tdt` · Packagist `azuracast/azuracast`: affected `<0.23.6`, fixed in `0.23.6` · CVSS 8.7 High · Not analysed yet · Published 4 May 2026 · Tags: Code injection
- [Sandboxed Thymeleaf expressions vulnerable to improper recognition of unauthorized syntax patterns](https://agentprime.io/advisories/GHSA-c9ph-gxww-7744.md)
  `GHSA-c9ph-gxww-7744`, `CVE-2026-41901` · Maven `org.thymeleaf:thymeleaf` and 2 more: affected `<3.1.5.RELEASE`, fixed in `3.1.5.RELEASE` · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 May 2026 · Tags: Code injection
- [pyp2spec is Vulnerable to Code Injection](https://agentprime.io/advisories/GHSA-r35x-v8p8-xvhw.md)
  `GHSA-r35x-v8p8-xvhw`, `CVE-2026-42301`, `PYSEC-2026-3003` · PyPI `pyp2spec`: affected `<0.14.1`, fixed in `0.14.1` · CVSS 7.8 High · Not analysed yet · Published 4 May 2026 · Tags: Code injection, CWE-20
- [OpenMRS has Stored Velocity SSTI to RCE via ConceptReferenceRange](https://agentprime.io/advisories/GHSA-xj4f-8jjg-vx4q.md)
  `GHSA-xj4f-8jjg-vx4q`, `CVE-2026-41258` · Maven `org.openmrs.api:openmrs-api`: affected `>=2.7.0, <2.7.9 || >=2.8.0, <2.8.6`, fixed in `2.7.9`, `2.8.6` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 May 2026 · Tags: Code injection
- [Apache Polaris has an Improper Input Validation issue](https://agentprime.io/advisories/GHSA-fc3h-c6h7-r83j.md)
  `GHSA-fc3h-c6h7-r83j`, `CVE-2026-42811` · Maven `org.apache.polaris:polaris-core`: affected `<1.4.1`, fixed in `1.4.1` · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 May 2026 · Tags: Code injection, CWE-20
- [Apache OpenNLP ExtensionLoader Vulnerable to Arbitrary Class Instantiation via Model Manifest](https://agentprime.io/advisories/GHSA-cx4m-2p55-rw7j.md)
  `GHSA-cx4m-2p55-rw7j`, `CVE-2026-42027` · Maven `org.apache.opennlp:opennlp-tools`: affected `>=2.0.0, <2.5.9 || >=3.0.0-M1, <3.0.0-M3 || <1.9.5`, fixed in `2.5.9`, `3.0.0-M3`, `1.9.5` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 May 2026 · Tags: Code injection, Insecure deserialization
- [Apache Atlas has a Code Injection Vulnerability](https://agentprime.io/advisories/GHSA-35xx-9xrg-gwhf.md)
  `GHSA-35xx-9xrg-gwhf`, `CVE-2026-40563` · Maven `org.apache.atlas:apache-atlas`: affected `>=0.8, <2.5.0`, fixed in `2.5.0` · CVSS 7.1 High · Not analysed yet · Published 4 May 2026 · Tags: Code injection
- [Notesnook: RCE via stored XSS in note export rendering](https://agentprime.io/advisories/CVE-2026-42090.md)
  `CVE-2026-42090` · CVE record: streetwriters notesnook · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 May 2026 · Tags: Cross-site scripting (XSS), Code injection
- [VM2 Sandbox Breakout Through \_\_lookupGetter\_\_](https://agentprime.io/advisories/GHSA-grj5-jjm8-h35p.md)
  `GHSA-grj5-jjm8-h35p`, `CVE-2026-24118` · npm `vm2`: affected `<3.11.0`, fixed in `3.11.0` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 May 2026 · Tags: Code injection, CWE-693, CWE-749
- [RCE in Profelis Informatics' SambaBox](https://agentprime.io/advisories/CVE-2026-3120.md)
  `CVE-2026-3120` · CVE record: Profelis Information and Consulting Trade and Industry Limited Company SambaBox · CVSS 7.2 High · Not analysed yet · Published 4 May 2026 · Tags: Code injection
- [An issue in Lymphatus caesium-image-compressor All versions up to and including commit 02da2c6 allows a local attacker to execute arbitrary code via the shutdownMachine and putMachineToSleep function…](https://agentprime.io/advisories/CVE-2026-36365.md)
  `CVE-2026-36365` · CVE record · CVSS 7.8 High · Not analysed yet · Published 4 May 2026 · Tags: Command injection, Code injection
- [AV Stumpfl Pixera Two Media Server Websocket API code injection](https://agentprime.io/advisories/CVE-2026-7703.md)
  `CVE-2026-7703` · CVE record: AV Stumpfl Pixera Two Media Server · CVSS 6.9 Medium · Not analysed yet · Published 3 May 2026 · Tags: Other injection, Code injection
- [kerwincui FastBee System Notice SysNoticeController.java add cross site scripting](https://agentprime.io/advisories/CVE-2026-7677.md)
  `CVE-2026-7677` · CVE record: kerwincui FastBee · CVSS 5.1 Medium · Not analysed yet · Published 3 May 2026 · Tags: Cross-site scripting (XSS), Code injection
- [SGLang has an Improper Input Validation/Injection Issue](https://agentprime.io/advisories/GHSA-6m5f-673f-5vh7.md)
  `GHSA-6m5f-673f-5vh7`, `CVE-2026-7669`, `PYSEC-2026-3062` · PyPI `sglang`: affected `<=0.5.9`, no fixed version yet · CVSS 6.3 Medium · Not analysed yet · Published 3 May 2026 · Tags: Other injection, Code injection, CWE-20
- [Widget Options <= 4.2.2 - Authenticated (Contributor+) Remote Code Execution via Display Logic](https://agentprime.io/advisories/CVE-2026-2052.md)
  `CVE-2026-2052` · CVE record: marketingfire Widget Options – Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets and 1 more · CVSS 8.8 High · Not analysed yet · Published 2 May 2026 · Tags: Code injection
- [nextlevelbuilder ui-ux-pro-max-skill Slide Generator generate-slide.py data.get cross site scripting](https://agentprime.io/advisories/CVE-2026-7596.md)
  `CVE-2026-7596` · CVE record: nextlevelbuilder ui-ux-pro-max-skill · CVSS 5.3 Medium · Not analysed yet · Published 1 May 2026 · Tags: Cross-site scripting (XSS), Code injection
- [nextlevelbuilder ui-ux-pro-max-skill Tailwind Config Generator tailwind_config_gen.py \_format_plugins code injection](https://agentprime.io/advisories/CVE-2026-7595.md)
  `CVE-2026-7595` · CVE record: nextlevelbuilder ui-ux-pro-max-skill · CVSS 5.3 Medium · Not analysed yet · Published 1 May 2026 · Tags: Other injection, Code injection
- [Exiftool JPEG/QuickTime/MOV/MP4 GM.pm Process_mrld code injection](https://agentprime.io/advisories/CVE-2026-7580.md)
  `CVE-2026-7580` · CVE record: Exiftool · CVSS 4.8 Medium · Not analysed yet · Published 1 May 2026 · Tags: Other injection, Code injection
- [Bootstrap CMS Page Creation show.blade.php code injection](https://agentprime.io/advisories/CVE-2026-7508.md)
  `CVE-2026-7508` · CVE record: Bootstrap CMS · CVSS 5.3 Medium · Not analysed yet · Published 30 Apr 2026 · Tags: Other injection, Code injection
- [Authenticated Remote Code Execution Vulnerability in Langflow Code Validation Endpoint](https://agentprime.io/advisories/CVE-2026-6543.md)
  `CVE-2026-6543` · CVE record: IBM Langflow Desktop · CVSS 8.8 High · Not analysed yet · Published 30 Apr 2026 · Tags: Code injection
- [LinkStackOrg LinkStack UserController.php editPage cross site scripting](https://agentprime.io/advisories/CVE-2026-7501.md)
  `CVE-2026-7501` · CVE record: LinkStackOrg LinkStack · CVSS 5.1 Medium · Not analysed yet · Published 30 Apr 2026 · Tags: Cross-site scripting (XSS), Code injection
- [Krayin CRM allows a remote attacker to execute arbitrary code via compose email function](https://agentprime.io/advisories/GHSA-32px-ccfx-cxq3.md)
  `GHSA-32px-ccfx-cxq3`, `CVE-2026-36340`, `PKSA-vkyr-b96k-z2ks` · Packagist `krayin/laravel-crm`: affected `>=2.1.5, <2.1.6`, fixed in `2.1.6` · CVSS 8.1 High · Not analysed yet · Published 30 Apr 2026 · Tags: Code injection
- [Possible QML code injection in VectorImage component](https://agentprime.io/advisories/CVE-2025-14576.md)
  `CVE-2025-14576` · CVE record: Qt Qt · CVSS 7.4 High · Not analysed yet · Published 30 Apr 2026 · Tags: Code injection, CWE-20
- [n8n has a Python Task Runner Sandbox Escape Vulnerability](https://agentprime.io/advisories/GHSA-44v6-jhgm-p3m4.md)
  `GHSA-44v6-jhgm-p3m4`, `CVE-2026-42234` · npm `n8n`: affected `<1.123.32 || >=2.17.0, <2.17.4 || >=2.18.0, <2.18.1`, fixed in `1.123.32`, `2.17.4`, `2.18.1` · CVSS 7.1 High · Not analysed yet · Published 29 Apr 2026 · Tags: Code injection
- [Cockpit CMS Authenticated Remote Code Execution via Collections](https://agentprime.io/advisories/CVE-2026-34965.md)
  `CVE-2026-34965` · CVE record: Cockpit Cockpit CMS · CVSS 8.7 High · Not analysed yet · Published 29 Apr 2026 · Tags: Code injection
- [SourceCodester CET Automated Grading System with AI Predictive Analytics Registration index.php register cross site scripting](https://agentprime.io/advisories/CVE-2026-7401.md)
  `CVE-2026-7401` · CVE record: SourceCodester CET Automated Grading System with AI Predictive Analytics · CVSS 5.3 Medium · Not analysed yet · Published 29 Apr 2026 · Tags: Cross-site scripting (XSS), Code injection
- [AgentFlow Arbitrary Python Pipeline Execution via pipeline_path](https://agentprime.io/advisories/CVE-2026-7466.md)
  `CVE-2026-7466` · CVE record: berabuddies AgentFlow · CVSS 7.7 High · Not analysed yet · Published 29 Apr 2026 · Tags: Code injection
- [SourceCodester Pharmacy Sales and Inventory System index.php customer cross site scripting](https://agentprime.io/advisories/CVE-2026-7390.md)
  `CVE-2026-7390` · CVE record: SourceCodester Pharmacy Sales and Inventory System · CVSS 5.1 Medium · Not analysed yet · Published 29 Apr 2026 · Tags: Cross-site scripting (XSS), Code injection
- [Cockpit is vulnerable to arbitrary code execution](https://agentprime.io/advisories/GHSA-fm6c-rhcf-7439.md)
  `GHSA-fm6c-rhcf-7439`, `CVE-2026-38992`, `PKSA-496r-cnzn-ck12` · Packagist `cockpit-hq/cockpit`: affected `<2.14.0`, fixed in `2.14.0` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Apr 2026 · Tags: Code injection
- [EyouCMS Template File FilemanagerLogic.php editFile code injection](https://agentprime.io/advisories/CVE-2026-7388.md)
  `CVE-2026-7388` · CVE record: EyouCMS · CVSS 5.1 Medium · Not analysed yet · Published 29 Apr 2026 · Tags: Other injection, Code injection
- [SourceCodester Pizzafy Ecommerce System ajax.php save_user cross site scripting](https://agentprime.io/advisories/CVE-2026-7297.md)
  `CVE-2026-7297` · CVE record: SourceCodester Pizzafy Ecommerce System · CVSS 4.8 Medium · Not analysed yet · Published 28 Apr 2026 · Tags: Cross-site scripting (XSS), Code injection
- [SourceCodester Pizzafy Ecommerce System ajax.php save_order cross site scripting](https://agentprime.io/advisories/CVE-2026-7296.md)
  `CVE-2026-7296` · CVE record: SourceCodester Pizzafy Ecommerce System · CVSS 4.8 Medium · Not analysed yet · Published 28 Apr 2026 · Tags: Cross-site scripting (XSS), Code injection
- [SourceCodester Pizzafy Ecommerce System ajax.php save_menu cross site scripting](https://agentprime.io/advisories/CVE-2026-7295.md)
  `CVE-2026-7295` · CVE record: SourceCodester Pizzafy Ecommerce System · CVSS 4.8 Medium · Not analysed yet · Published 28 Apr 2026 · Tags: Cross-site scripting (XSS), Code injection
- [SourceCodester Pizzafy Ecommerce System index.php save_settings cross site scripting](https://agentprime.io/advisories/CVE-2026-7294.md)
  `CVE-2026-7294` · CVE record: SourceCodester Pizzafy Ecommerce System · CVSS 4.8 Medium · Not analysed yet · Published 28 Apr 2026 · Tags: Cross-site scripting (XSS), Code injection
- [OpenCATS PHP Code Injection via installer AJAX endpoint](https://agentprime.io/advisories/CVE-2026-27760.md)
  `CVE-2026-27760` · CVE record: opencats OpenCATS · CVSS 9.2 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.33 · Not analysed yet · Published 28 Apr 2026 · Tags: Code injection
- [SourceCodester Pharmacy Sales and Inventory System index.php supplier cross site scripting](https://agentprime.io/advisories/CVE-2026-7281.md)
  `CVE-2026-7281` · CVE record: SourceCodester Pharmacy Sales and Inventory System · CVSS 4.8 Medium · Not analysed yet · Published 28 Apr 2026 · Tags: Cross-site scripting (XSS), Code injection
- [SourceCodester Pharmacy Sales and Inventory System index.php cross site scripting](https://agentprime.io/advisories/CVE-2026-7269.md)
  `CVE-2026-7269` · CVE record: SourceCodester Pharmacy Sales and Inventory System · CVSS 4.8 Medium · Not analysed yet · Published 28 Apr 2026 · Tags: Cross-site scripting (XSS), Code injection
- [Spring AI has a VectorStore FilterExpression Converter injection](https://agentprime.io/advisories/GHSA-qc4j-qjqx-vr58.md)
  `GHSA-qc4j-qjqx-vr58`, `CVE-2026-40967` · Maven `org.springframework.ai:spring-ai-vector-store`: affected `>=1.0.0, <1.0.6 || >=1.1.0, <1.1.5`, fixed in `1.0.6`, `1.1.5` · CVSS 8.6 High · Not analysed yet · Published 28 Apr 2026 · Tags: Code injection
- [SourceCodester Safety Anger Pad cross site scripting](https://agentprime.io/advisories/CVE-2026-7230.md)
  `CVE-2026-7230` · CVE record: SourceCodester Safety Anger Pad · CVSS 5.3 Medium · Not analysed yet · Published 28 Apr 2026 · Tags: Cross-site scripting (XSS), Code injection
- [code-projects Coaching Management System Complaint Form complaint.php cross site scripting](https://agentprime.io/advisories/CVE-2026-7222.md)
  `CVE-2026-7222` · CVE record: code-projects Coaching Management System · CVSS 5.1 Medium · Not analysed yet · Published 28 Apr 2026 · Tags: Cross-site scripting (XSS), Code injection
- [SourceCodester Pharmacy Sales and Inventory System index.php cross site scripting](https://agentprime.io/advisories/CVE-2026-7200.md)
  `CVE-2026-7200` · CVE record: SourceCodester Pharmacy Sales and Inventory System · CVSS 5.3 Medium · Not analysed yet · Published 27 Apr 2026 · Tags: Cross-site scripting (XSS), Code injection
- [Arbitrary Code Execution via Sandbox Bypass in the open source solution QnABot on AWS](https://agentprime.io/advisories/CVE-2026-7191.md)
  `CVE-2026-7191` · CVE record: AWS QnABot on AWS · CVSS 8.6 High · Not analysed yet · Published 27 Apr 2026 · Tags: Code injection
- [SourceCodester Pharmacy Sales and Inventory System index.php cross site scripting](https://agentprime.io/advisories/CVE-2026-7129.md)
  `CVE-2026-7129` · CVE record: SourceCodester Pharmacy Sales and Inventory System · CVSS 5.3 Medium · Not analysed yet · Published 27 Apr 2026 · Tags: Cross-site scripting (XSS), Code injection
- [code-projects Employee Management System mark.php cross site scripting](https://agentprime.io/advisories/CVE-2026-7116.md)
  `CVE-2026-7116` · CVE record: code-projects Employee Management System · CVSS 5.3 Medium · Not analysed yet · Published 27 Apr 2026 · Tags: Cross-site scripting (XSS), Code injection
- [code-projects Invoice System in Laravel item cross site scripting](https://agentprime.io/advisories/CVE-2026-7110.md)
  `CVE-2026-7110` · CVE record: code-projects Invoice System in Laravel · CVSS 5.1 Medium · Not analysed yet · Published 27 Apr 2026 · Tags: Cross-site scripting (XSS), Code injection
- [code-projects Employee Management System edit.php cross site scripting](https://agentprime.io/advisories/CVE-2026-7095.md)
  `CVE-2026-7095` · CVE record: code-projects Employee Management System · CVSS 5.3 Medium · Not analysed yet · Published 27 Apr 2026 · Tags: Cross-site scripting (XSS), Code injection
- [code-projects Chat System send_message.php cross site scripting](https://agentprime.io/advisories/CVE-2026-7090.md)
  `CVE-2026-7090` · CVE record: code-projects Chat System · CVSS 4.8 Medium · Not analysed yet · Published 27 Apr 2026 · Tags: Cross-site scripting (XSS), Code injection
- [code-projects Home Service System Appointment Booking booking.php cross site scripting](https://agentprime.io/advisories/CVE-2026-7089.md)
  `CVE-2026-7089` · CVE record: code-projects Home Service System · CVSS 5.3 Medium · Not analysed yet · Published 27 Apr 2026 · Tags: Cross-site scripting (XSS), Code injection
- [D-Link DSL-2740R Wireless Setup Section cross site scripting](https://agentprime.io/advisories/CVE-2026-7027.md)
  `CVE-2026-7027` · CVE record: D-Link DSL-2740R · CVSS 4.8 Medium · Not analysed yet · Published 26 Apr 2026 · Tags: Cross-site scripting (XSS), Code injection
- [D-Link DGS-3420 System Information Settings cross site scripting](https://agentprime.io/advisories/CVE-2026-7026.md)
  `CVE-2026-7026` · CVE record: D-Link DGS-3420 · CVSS 6.8 Medium · Not analysed yet · Published 26 Apr 2026 · Tags: Cross-site scripting (XSS), Code injection
- [MaxSite CMS ushki Plugin cross site scripting](https://agentprime.io/advisories/CVE-2026-7016.md)
  `CVE-2026-7016` · CVE record: MaxSite CMS · CVSS 4.8 Medium · Not analysed yet · Published 26 Apr 2026 · Tags: Cross-site scripting (XSS), Code injection
- [MaxSite CMS Guestbook Plugin cross site scripting](https://agentprime.io/advisories/CVE-2026-7015.md)
  `CVE-2026-7015` · CVE record: MaxSite CMS · CVSS 4.8 Medium · Not analysed yet · Published 26 Apr 2026 · Tags: Cross-site scripting (XSS), Code injection
- [MaxSite CMS down_count Plugin cross site scripting](https://agentprime.io/advisories/CVE-2026-7014.md)
  `CVE-2026-7014` · CVE record: MaxSite CMS · CVSS 4.8 Medium · Not analysed yet · Published 26 Apr 2026 · Tags: Cross-site scripting (XSS), Code injection
- [MaxSite CMS mail_send Plugin cross site scripting](https://agentprime.io/advisories/CVE-2026-7013.md)
  `CVE-2026-7013` · CVE record: MaxSite CMS · CVSS 4.8 Medium · Not analysed yet · Published 26 Apr 2026 · Tags: Cross-site scripting (XSS), Code injection
- [MaxSite CMS Redirect Plugin cross site scripting](https://agentprime.io/advisories/CVE-2026-7012.md)
  `CVE-2026-7012` · CVE record: MaxSite CMS · CVSS 4.8 Medium · Not analysed yet · Published 26 Apr 2026 · Tags: Cross-site scripting (XSS), Code injection
- [MaxSite CMS Antispam Plugin plugin_antispam cross site scripting](https://agentprime.io/advisories/CVE-2026-7011.md)
  `CVE-2026-7011` · CVE record: MaxSite CMS · CVSS 4.8 Medium · Not analysed yet · Published 26 Apr 2026 · Tags: Cross-site scripting (XSS), Code injection
- [Datacom DM4100 Ethernet Configuration cross site scripting](https://agentprime.io/advisories/CVE-2026-7001.md)
  `CVE-2026-7001` · CVE record: Datacom DM4100 · CVSS 4.8 Medium · Not analysed yet · Published 25 Apr 2026 · Tags: Cross-site scripting (XSS), Code injection
- [Datacom DM4100 VLAN Page cross site scripting](https://agentprime.io/advisories/CVE-2026-7000.md)
  `CVE-2026-7000` · CVE record: Datacom DM4100 · CVSS 4.8 Medium · Not analysed yet · Published 25 Apr 2026 · Tags: Cross-site scripting (XSS), Code injection

Newest: <https://agentprime.io/advisories/tag/code-injection.md>
Older: <https://agentprime.io/advisories/tag/code-injection.md?cursor=WyIyMDI2LTA0LTI1VDIxOjAwOjI0LjEyMTAwMFoiLCJDVkUtMjAyNi03MDAwIl0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=code-injection&cursor=WyIyMDI2LTA1LTA1VDE2OjIzOjM1LjAwMDAwMFoiLCJHSFNBLXF2amotMjlxZi1ocDdwIl0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/code-injection/?cursor=WyIyMDI2LTA1LTA1VDE2OjIzOjM1LjAwMDAwMFoiLCJHSFNBLXF2amotMjlxZi1ocDdwIl0>. Everything for agents: <https://agentprime.io/llms.txt>.